Is CVE-2026-10283 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10283 being exploited in the wild.

How severe is CVE-2026-10283?

Medium severity, with a CVSS score of 6.3, published 1 June 2026.

Which products and versions are affected?

Bottelet DaybydayCRM up to 2.2.1.

Is there a fix for CVE-2026-10283?

A patch was published on 2026-04-08: Fix merged in pull request #363 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10283 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10283?

Check whether you run Bottelet DaybydayCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10283: Bottelet DaybydayCRM missing authentication in Setting Handler

CVE-2026-10283 · Severity: medium · CVSS 6.3 · Published 2026-06-01

Bottelet DaybydayCRM, an open-source customer relationship management platform, contains multiple authorization flaws that allow users to perform actions beyond their intended permissions. Specifically, the 'Setting Handler' and various resource controllers fail to verify if a user has administrative rights before allowing them to modify global system settings or delete critical data like clients, tasks, and projects. An authenticated attacker could exploit this to disrupt business operations, delete customer records, or change company-wide configurations such as tax rates and currency settings.

Technologies: Bottelet DaybydayCRM. Vendors: Bottelet.

Quick answers

Is CVE-2026-10283 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10283 being exploited in the wild.
How severe is CVE-2026-10283?: Medium severity, with a CVSS score of 6.3, published 1 June 2026.
Which products and versions are affected?: Bottelet DaybydayCRM up to 2.2.1.
Is there a fix for CVE-2026-10283?: A patch was published on 2026-04-08: Fix merged in pull request #363 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10283 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10283?: Check whether you run Bottelet DaybydayCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A systemic authorization vulnerability exists in Bottelet DaybydayCRM through version 2.2.1 due to permissions being defined in the database seeder but not enforced within the controller logic. The 'Setting Handler' (SettingsController.php) only applies administrative middleware to the index view, leaving the updateOverall and updateFirstStep methods unprotected. Additionally, delete operations across Users, Clients, Tasks, Leads, Projects, and Offers controllers lack 'destroy' method permission checks. A remote authenticated attacker can exploit these flaws to modify global system configurations (VAT rates, currency, business hours) or perform unauthorized deletions of CRM resources. The issue is addressed in pull request #363 by enforcing middleware-based permission checks and implementing mass assignment protection.

Affected products

Bottelet DaybydayCRM up to 2.2.1

Timeline

2026-03-04: disclosed: Vulnerability reported via GitHub issue #348
2026-04-08: patched: Fix merged in pull request #363
2026-06-01: advisory: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.