CVE-2026-61519

Received Received - Intake

Broken Access Control in Liberu CRM Allows Privilege Escalation

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulnCheck

Description

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invitation rights based solely on the existence of a pending invitation email match. Attackers can send a POST request to the team-invitations route specifying the admin role for a second account, bypassing privilege-level validation in InviteTeamMember, causing the second account upon invitation acceptance to be attached to the team with full admin-level create, read, update, and delete access over all team-scoped data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-09-30

AI Q&A

2026-09-30

EPSS Evaluated

N/A

NVD

CVE-2026-61519

EUVD

EUVD-2026-89339

Affected Vendors & Products

Vendor	Product	Version / Range
liberu	crm	to 10.0.0 (exc)
liberusoftware	liberu_crm	to 10.0.0 (exc)
liberusoftware	liberu_crm	From 0.9.1 (inc) to 9.9.99 (inc)
liberusoftware	crm_laravel	to 2.0.1 (inc)
liberusoftware	crm_laravel	10.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2026-61519 is a broken access control vulnerability in Liberu CRM versions 0.9.1 through 9.9.99. It allows any user with a pending team invitation to invite additional accounts with elevated privileges. The flaw exists in the TeamPolicy::addTeamMember() function, where the system grants invitation rights based solely on matching a pending invitation email without verifying proper authorization levels. Attackers can send a crafted POST request to the team-invitations endpoint, specify the admin role for a second account, and bypass privilege validation. Upon acceptance, the second account gains full admin-level access to all team data.

Detection Guidance

To detect this vulnerability, inspect the team-invitations endpoint in Liberu CRM for improper authorization checks. Check if pending invitation emails allow unauthorized admin role assignments. Review logs for POST requests to team-invitations with elevated role parameters. Verify if TeamPolicy::addTeamMember() grants access based solely on email matches without proper validation.

Impact Analysis

This vulnerability allows attackers to escalate their privileges and gain full admin access to a team's data. They can invite additional accounts with admin rights, enabling unauthorized creation, reading, updating, or deletion of sensitive team information. This could lead to data breaches, unauthorized modifications, or complete compromise of the CRM system and its data.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in non-compliance due to insufficient access controls, potential data breaches, and lack of proper authorization mechanisms for handling personal or protected health information.

Mitigation Strategies

Immediately upgrade to Liberu CRM version 10.0.0 or later to patch the broken access control. If upgrading is not possible, disable the team-invitations endpoint or restrict POST requests to it. Implement stricter authorization checks in TeamPolicy::addTeamMember() to validate privilege levels before granting access. Enable GitHub's private vulnerability reporting and add a SECURITY.md file for future disclosures.

Hi! I’m here to help you understand CVE-2026-61519. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70