Bottelet CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Bottelet CVE published 2026-10-24

CVE-2026-116008

A missing authorization vulnerability exists in DaybydayCRM through version 2.2.1, specifically in the ProjectsController::updateAssign() method. This allows any authenticated user to reassign projects without needing the can-assign-new-user-to-project permission. Low-privileged employees can exploit this by sending PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned [truncated]