CVE-2026-116008 Bottelet CVE debrief

Who should care

System administrators and security teams responsible for DaybydayCRM installations should assess exposure and prioritize remediation. Authentication and authorization controls should be reviewed and enhanced to prevent unauthorized project reassignment.

Why it matters

CVE-2026-116008 is a medium-severity vulnerability in DaybydayCRM that allows any authenticated user to reassign projects without proper authorization. This could lead to unauthorized changes in project ownership and notification redirection. System administrators and security teams should review and enhance authentication and authorization controls, monitor for suspicious activity, and prioritize remediation.

• Potential unauthorized project reassignment by low-privileged users
• Possible redirection of project ownership and notifications
• Need for review and enhancement of authentication and authorization controls
• Priority for monitoring project reassignment requests for suspicious activity

Technical summary

The ProjectsController::updateAssign() method in DaybydayCRM through version 2.2.1 does not properly check if the user has the can-assign-new-user-to-project permission before allowing project reassignment. This can be exploited by any authenticated user, including low-privileged employees, by sending specific HTTP requests to /projects/updateassign/{external_id}. The vulnerability allows for unauthorized changes in project ownership and notification redirection, emphasizing the need for enhanced authentication and authorization controls.

Defensive priority

Medium priority for authentication and authorization controls review

Recommended defensive actions

• Review and enhance authentication and authorization controls for project reassignment functionality
• Implement proper permission checks for user actions related to project ownership
• Monitor project reassignment requests for suspicious activity
• Update DaybydayCRM to a version that includes the fix for this vulnerability, if available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability is confirmed in DaybydayCRM version 2.2.1. The ProjectsController::updateAssign() method lacks proper authorization checks, allowing unauthorized project reassignment. This issue is verified through source-item details and may affect deployments with default or custom configurations. Limited information is available on non-standard deployments, and defenders should verify specific configurations and review access controls for /projects/updateassign/{external_id} endpoints.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.