# CVE-2026-10282: Bottelet DaybydayCRM improper authorization in DocumentsController

Source: https://junglewise.ai/threats/cve-2026-10282-bottelet-daybydaycrm-improper-authorization-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-10282 · Severity: medium · CVSS 4.3 · Published 2026-06-01

Bottelet DaybydayCRM, an open-source customer relationship management platform, contains a security flaw that allows logged-in users to access documents they do not own. By manipulating document identifiers, an attacker could view or download sensitive files associated with other clients, tasks, or projects. This could lead to the unauthorized exposure of confidential business information and customer data.

Technologies: [Bottelet DaybydayCRM](https://junglewise.ai/threats/technologies/daybydaycrm). Vendors: [Bottelet](https://junglewise.ai/threats/vendors/bottelet).

## Quick answers

**Is CVE-2026-10282 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10282 being exploited in the wild.

**How severe is CVE-2026-10282?** Medium severity, with a CVSS score of 4.3, published 1 June 2026.

**Which products and versions are affected?** Bottelet DaybydayCRM up to 2.2.1.

**Is there a fix for CVE-2026-10282?** A patch was published on 2026-04-08: Fix merged in pull request #362 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10282 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10282?** Check whether you run Bottelet DaybydayCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in Bottelet DaybydayCRM up to 2.2.1 within the `view` and `download` methods of `app/Http/Controllers/DocumentsController.php`. The application fails to perform ownership or permission checks when retrieving documents via their `external_id`, allowing any authenticated user to access files by guessing or obtaining the identifier. Additionally, missing permission checks were identified in the `updateAssign` methods of the Tasks, Projects, and Leads controllers. An attacker with low-privileged network access can exploit this to bypass intended access controls. A patch has been developed to implement proper authorization gates and ownership validation.

## Affected products

- Bottelet DaybydayCRM up to 2.2.1

## Timeline

- 2026-02-25: disclosed: Vulnerability reported via GitHub issue #347
- 2026-04-08: patched: Fix merged in pull request #362
- 2026-06-01: advisory: CVE-2026-10282 published

## References

- [https://github.com/Bottelet/DaybydayCRM/](https://github.com/Bottelet/DaybydayCRM/)
- [https://github.com/Bottelet/DaybydayCRM/issues/347](https://github.com/Bottelet/DaybydayCRM/issues/347)
- [https://github.com/Bottelet/DaybydayCRM/pull/362](https://github.com/Bottelet/DaybydayCRM/pull/362)
- [https://vuldb.com/cve/CVE-2026-10282](https://vuldb.com/cve/CVE-2026-10282)
- [https://vuldb.com/submit/825439](https://vuldb.com/submit/825439)
- [https://vuldb.com/submit/825440](https://vuldb.com/submit/825440)
- [https://vuldb.com/vuln/367575](https://vuldb.com/vuln/367575)

## Related threats

- [DaybydayCRM missing authorization in ProjectsController::updateAssign](https://junglewise.ai/threats/cve-2026-116008-daybydaycrm-through-2-2-1-contains-a-missing-authorization)
- [Bottelet DaybydayCRM missing authentication in Setting Handler](https://junglewise.ai/threats/cve-2026-10283-bottelet-daybydaycrm-missing-authentication-in-setting-handler)