Is there a public PoC exploit available for EUVD-2026-27153?

Yes, a public proof-of-concept exploit is available for EUVD-2026-27153. Prioritise patching immediately. EPSS: 0.0%.

Perfex CRM EUVD-2026-27153

Q: What is the CVSS score of EUVD-2026-27153?

EUVD-2026-27153 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7782 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-04 VulDB

Authentication Bypass PHP

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 04, 2026 - 23:30 vuln.today

Severity Changed

May 04, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

May 04, 2026 - 23:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1. This affects the function Clients::project of the file application/controllers/Clients.php of the component Tenant Handler. The manipulation of the argument ID results in authorization bypass. The attack may be performed from remote. The exploit is now public and may be used.

AnalysisAI

Authorization bypass in CodeCanyon Perfex CRM up to 3.4.1 allows authenticated remote attackers to access projects belonging to other tenants via manipulation of the ID parameter in the Clients::project function. The vulnerability requires valid user credentials but grants access to cross-tenant data with low confidentiality, integrity, and availability impact. Publicly available exploit code exists for this flaw.

Technical ContextAI

Perfex CRM is a multi-tenant customer relationship management system built in PHP. The vulnerability exists in the Clients controller (application/controllers/Clients.php), specifically in the project function responsible for handling tenant-scoped project access. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to properly validate that the requested project ID belongs to the authenticated user's tenant before granting access. The tenant handler component, which should enforce tenant isolation, does not sufficiently validate the relationship between the user's tenant context and the resource being accessed. This is a classic multi-tenant architecture weakness where tenant isolation is enforced by convention or session state rather than explicit authorization checks per resource.

RemediationAI

Upgrade Perfex CRM to a version newer than 3.4.1 that includes tenant authorization checks in the Clients::project function. If immediate upgrade is not possible, implement the following compensating controls: (1) Enforce strict access control middleware that validates the project's tenant association against the authenticated user's tenant context before allowing the Clients::project function to execute - this requires code review of the tenant handler component to add explicit authorization gates. (2) Apply network-level restrictions by limiting CRM access to specific IP ranges or VPN endpoints to reduce the pool of potential authenticated users. (3) Implement real-time audit logging on all project access attempts (including failed authorizations) and monitor for cross-tenant access patterns that indicate exploitation attempts. (4) Review and revoke credentials for any user accounts that may have been created for testing or shared among multiple organizations. (5) If the application supports it, disable the projects feature entirely for tenants that do not require it. These controls mitigate exploitation but do not eliminate the vulnerability; patching remains the primary remediation path. Monitor VulDB and CodeCanyon security advisories for patch availability and version 3.4.2 or later release notes.