EUVD-2026-60011
GHSA-j847-pxxw-4m9g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IDOR requiring low-privilege authentication; contact record tampering yields limited integrity and availability impact with no confidentiality breach.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_contact of the component Contact Information Update. Such manipulation of the argument contact_id leads to authorization bypass. The attack can be launched remotely. The exploit is publicly available and might be used.
AnalysisAI
Authorization bypass in CodeCanyon's TimeCamp Integration for CRM (all versions through 2.8) allows authenticated remote attackers to manipulate the contact_id parameter submitted to the /clients/save_contact endpoint, overwriting or corrupting contact records belonging to other users without owning those records. The flaw is a classic Insecure Direct Object Reference (CWE-639): the application trusts the caller-supplied contact_id without verifying record ownership against the authenticated session. Publicly available exploit code exists on GitHub, materially lowering the barrier to exploitation.
Technical ContextAI
The vulnerability resides in the /clients/save_contact handler of the CodeCanyon TimeCamp Integration for CRM plugin (CPE: cpe:2.3:a:codecanyon:timecamp_integration_for_crm:*:*:*:*:*:*:*:*), a marketplace plugin that bridges TimeCamp time-tracking with CRM contact management. CWE-639 (Authorization Bypass Through User-Controlled Key) describes a design flaw where an application uses a caller-supplied identifier - here, contact_id - as the sole basis for selecting a resource to act upon, without confirming that the authenticated principal owns or has rights over that resource. This is the canonical IDOR pattern: the server's save-contact logic performs a write operation against whichever contact record the submitted identifier resolves to, making enumeration or guessing of contact identifiers sufficient for cross-account tampering.
RemediationAI
No vendor-released patch has been identified at time of analysis - the available CPE range covers all versions through 2.8 with no fixed version specified in any referenced advisory. Operators should immediately check the CodeCanyon marketplace listing for an updated plugin release. As a compensating control, configure a web application firewall or reverse proxy rule to intercept POST requests to /clients/save_contact and validate that the submitted contact_id corresponds to a record owned by the authenticated session before forwarding the request; note this requires custom middleware logic and will not protect against flaws in that logic itself. If the Contact Information Update feature is not operationally required, disabling or removing access to the /clients/save_contact route entirely eliminates the attack surface with no functional trade-off for unaffected workflows. Monitor https://vuldb.com/vuln/391143 for any vendor response or patch release.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today