CVE-2026-19966
Received Received - Intake

Authorization Bypass in CodeCanyon TimeCamp Integration for CRM

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_contact of the component Contact Information Update. Such manipulation of the argument contact_id leads to authorization bypass. The attack can be launched remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19966
EUVD
EUVD-2026-60011

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
codecanyon timecamp_integration_for_crm to 2.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the TimeCamp Integration for RISE CRM application. It allows authenticated users to modify other users' contact information without proper authorization checks. The issue occurs in the POST /clients/save_contact/ endpoint where the contact_id parameter is manipulated to reference and update another user's contact details due to missing server-side validation.

Detection Guidance

To detect this vulnerability, monitor POST requests to /clients/save_contact/ with the contact_id parameter. Check for requests where authenticated users attempt to modify contact details not belonging to them. Use tools like Burp Suite or OWASP ZAP to intercept and analyze these requests for improper authorization checks.

Impact Analysis

An attacker could exploit this to modify another user's contact information, leading to unauthorized data changes, privacy violations, or account takeover. This could result in loss of data integrity and potential manipulation of customer records.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of personal data, violating GDPR's data integrity and confidentiality principles. For HIPAA, it risks exposing protected health information (PHI) without authorization, potentially breaching compliance requirements.

Mitigation Strategies

Implement server-side authorization checks to verify that the authenticated user has permission to edit the requested contact_id. Ensure the application validates ownership of records before processing updates. Update to the latest patched version of TimeCamp Integration for CRM if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19966. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart