Is there a patch available for EUVD-2026-33746?

Yes, a patch is available for EUVD-2026-33746. Update the affected software to the latest version immediately.

DaybydayCRM EUVD-2026-33746

Q: What is the CVSS score of EUVD-2026-33746?

EUVD-2026-33746 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-10282 MEDIUM

Improper Authorization (CWE-285)

2026-06-01 VulDB

GHSA-9wcr-pjwm-2cv7

PHP Authentication Bypass

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 01, 2026 - 19:36 vuln.today

Analysis Generated

Jun 01, 2026 - 19:36 vuln.today

CVSS changed

Jun 01, 2026 - 19:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

DescriptionCVE.org

A security vulnerability has been detected in Bottelet DaybydayCRM up to 2.2.1. This impacts the function view of the file app/Http/Controllers/DocumentsController.php. Such manipulation leads to improper authorization. The attack may be launched remotely. It is best practice to apply a patch to resolve this issue.

AnalysisAI

Insecure Direct Object Reference in Bottelet DaybydayCRM up to version 2.2.1 allows any authenticated user to view or download arbitrary documents belonging to other users by enumerating the external_id URL parameter in DocumentsController. The missing authorization check in both the view() and download() methods means a low-privilege employee or contractor can exfiltrate documents linked to any Task, Project, Lead, or Client within the CRM. No public exploit identified at time of analysis and no CISA KEV listing, but the attack is trivially executable by any authenticated user given low complexity (AC:L, AT:N) and no user interaction required (UI:N).

Technical ContextAI

DaybydayCRM is an open-source PHP CRM application built on the Laravel framework, developed by Bottelet. The vulnerability resides in app/Http/Controllers/DocumentsController.php, where the view() and download() methods retrieve documents by a user-supplied external_id parameter without verifying that the requesting authenticated user has any ownership or assignment relationship to the document's source entity. This is a classic CWE-285 (Improper Authorization) manifestation, more precisely CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-862 (Missing Authorization) as confirmed by the PR changelog. Documents in DaybydayCRM are polymorphically linked to source entities (Task, Project, Lead, or Client), and the missing check allows any authenticated session to dereference any document by guessing or enumerating its external_id. The affected CPE is cpe:2.3:a:bottelet:daybydaycrm:*:*:*:*:*:*:*:*, covering all tracked versions up to 2.2.1.

RemediationAI

Apply the upstream fix from GitHub PR #362 (https://github.com/Bottelet/DaybydayCRM/pull/362), which introduces a canAccessDocument() authorization helper to both view() and download() methods in DocumentsController.php, granting access only if the authenticated user created the source entity (Task, Project, or Lead), is assigned to it, or owns the associated Client. This is an upstream fix available as a PR commit; a tagged/released patched version is not independently confirmed from available data - administrators should apply the patch manually from the PR diff or monitor the repository at https://github.com/Bottelet/DaybydayCRM/ for a tagged release. As a compensating control prior to patching, restrict CRM network access to authenticated internal VPN users only, reducing the exposed attack surface since exploitation requires a valid authenticated session (PR:L). Disabling document view and download routes at the web server or application level is an aggressive but effective workaround if document functionality is not immediately business-critical; this eliminates the attack vector entirely but removes document access for all users.