CVE-2026-116008 DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign

Medium 5.3 Published 24 Oct 2026 Updated 24 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116008?

CVE-2026-116008 is a medium-severity vulnerability in Bottelet DaybydayCRM, published on 24 Oct 2026.

Official description

DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.

Weakness: CWE-862

Which versions are affected by CVE-2026-116008?

How do I fix CVE-2026-116008?

No fix has been published for CVE-2026-116008 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116008 being exploited?

There is no known exploitation of CVE-2026-116008 in the wild and no public exploit code.

Sources

Also known as GHSA-cx4x-jmw3-mhpf.