Liberu Crm
Monthly
Broken access control in Liberu CRM 0.9.1 through releases before 10.0.0 lets an authenticated low-privileged user who already holds a pending team invitation escalate privileges and bind a second, attacker-controlled account to the team with full admin rights, granting create, read, update, and delete access over all team-scoped data. The root cause is a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invite rights based solely on whether the requesting email matches an outstanding invitation, combined with missing privilege-level validation in InviteTeamMember, so a POST to the team-invitations route specifying the 'admin' role is accepted. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-released fix is version 10.0.0, which removes the flaw.
Broken access control in Liberu CRM 0.9.1 through releases before 10.0.0 lets an authenticated low-privileged user who already holds a pending team invitation escalate privileges and bind a second, attacker-controlled account to the team with full admin rights, granting create, read, update, and delete access over all team-scoped data. The root cause is a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invite rights based solely on whether the requesting email matches an outstanding invitation, combined with missing privilege-level validation in InviteTeamMember, so a POST to the team-invitations route specifying the 'admin' role is accepted. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-released fix is version 10.0.0, which removes the flaw.