CVE-2026-66028
Received Received - Intake

Ekushey Project Manager CRM Missing Uniqueness Constraint Flaw

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: VulnCheck

Description
Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement to create conflicting account states where multiple accounts share the same email address with different passwords, resulting in unpredictable authentication behavior and unauthorized account access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-66028
EUVD
EUVD-2026-49392

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ekushey project_manager_crm to 5.0 (inc)
creativeitem ekushey_project_manager_crm to 5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-303 The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66028 is a missing uniqueness constraint vulnerability in Ekushey Project Manager CRM version 5.0 or below. It allows authenticated administrators to create multiple client accounts with the same email address but different passwords. This causes conflicting account states where the system fails to enforce email uniqueness, leading to unpredictable authentication behavior and potential unauthorized access.

Detection Guidance

To detect this vulnerability, check if multiple client accounts in Ekushey Project Manager CRM share the same email address. Query the database for duplicate emails using SQL commands like SELECT email, COUNT(*) FROM clients GROUP BY email HAVING COUNT(*) > 1. If duplicates exist, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to create duplicate accounts with the same email but different passwords, causing authentication conflicts. When a legitimate user tries to log in, the system may route access to the wrong account, enabling unauthorized access to sensitive data or system functions. It undermines secure account management and could lead to data breaches or account takeovers.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control under standards like GDPR and HIPAA. It risks unauthorized access to personal or sensitive data, which could lead to data breaches. Organizations using this software may fail to meet regulatory obligations for ensuring data integrity, confidentiality, and proper authentication mechanisms.

Mitigation Strategies

Immediately enforce a UNIQUE constraint on the client email field in the database. Update the CRM to version 5.1 or later if available. Review all client accounts for duplicates and merge or delete conflicting entries. Ensure no two accounts share the same email address.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66028. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart