CVE-2026-66028 Creativeitem CVE debrief

Who should care

Administrators and users of Ekushey Project Manager CRM should be aware of this vulnerability and take necessary precautions to prevent exploitation. They should verify and enforce email uniqueness constraints for client accounts, monitor for suspicious account creation activity, and implement additional authentication and authorization controls.

Technical summary

The vulnerability exists in Ekushey Project Manager CRM version 5.0 and earlier. The lack of email field uniqueness enforcement allows attackers to create conflicting account states where multiple accounts share the same email address with different passwords. This can lead to unpredictable authentication behavior and unauthorized account access. The vulnerability allows authenticated administrators to create duplicate client accounts with identical email and password credentials.

Defensive priority

High

Recommended defensive actions

• Verify and enforce email uniqueness constraints for client accounts
• Monitor for suspicious account creation activity
• Implement additional authentication and authorization controls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-27T18:17:00.090Z and last modified on 2026-07-27T19:17:22.173Z. The NVD entry is currently Received. The vulnerability affects Ekushey Project Manager CRM version 5.0 and earlier. The lack of email field uniqueness enforcement allows attackers to create conflicting account states where multiple accounts share the same email address with different passwords. Defenders should verify the affected product deployments in managed environments and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Official resources