Executive brief
Bottelet DaybydayCRM, an open-source customer relationship management platform, contains multiple authorization flaws that allow users to perform actions beyond their intended permissions. Specifically, the 'Setting Handler' and various resource controllers fail to verify if a user has administrative rights before allowing them to modify global system settings or delete critical data like clients, tasks, and projects. An authenticated attacker could exploit this to disrupt business operations, delete customer records, or change company-wide configurations such as tax rates and currency settings.
Technical details
A systemic authorization vulnerability exists in Bottelet DaybydayCRM through version 2.2.1 due to permissions being defined in the database seeder but not enforced within the controller logic. The 'Setting Handler' (SettingsController.php) only applies administrative middleware to the index view, leaving the updateOverall and updateFirstStep methods unprotected. Additionally, delete operations across Users, Clients, Tasks, Leads, Projects, and Offers controllers lack 'destroy' method permission checks. A remote authenticated attacker can exploit these flaws to modify global system configurations (VAT rates, currency, business hours) or perform unauthorized deletions of CRM resources. The issue is addressed in pull request #363 by enforcing middleware-based permission checks and implementing mass assignment protection.
Affected products
- Bottelet DaybydayCRM up to 2.2.1
Timeline
- 2026-03-04: disclosed: Vulnerability reported via GitHub issue #348
- 2026-04-08: patched: Fix merged in pull request #363
- 2026-06-01: advisory: CVE published and NVD record created