# CVE-2026-10283: Bottelet DaybydayCRM missing authentication in Setting Handler

Source: https://junglewise.ai/threats/cve-2026-10283-bottelet-daybydaycrm-missing-authentication-in-setting-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-10283 · Severity: medium · CVSS 6.3 · Published 2026-06-01

Bottelet DaybydayCRM, an open-source customer relationship management platform, contains multiple authorization flaws that allow users to perform actions beyond their intended permissions. Specifically, the 'Setting Handler' and various resource controllers fail to verify if a user has administrative rights before allowing them to modify global system settings or delete critical data like clients, tasks, and projects. An authenticated attacker could exploit this to disrupt business operations, delete customer records, or change company-wide configurations such as tax rates and currency settings.

Technologies: [Bottelet DaybydayCRM](https://junglewise.ai/threats/technologies/daybydaycrm). Vendors: [Bottelet](https://junglewise.ai/threats/vendors/bottelet).

## Quick answers

**Is CVE-2026-10283 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10283 being exploited in the wild.

**How severe is CVE-2026-10283?** Medium severity, with a CVSS score of 6.3, published 1 June 2026.

**Which products and versions are affected?** Bottelet DaybydayCRM up to 2.2.1.

**Is there a fix for CVE-2026-10283?** A patch was published on 2026-04-08: Fix merged in pull request #363 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10283 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10283?** Check whether you run Bottelet DaybydayCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A systemic authorization vulnerability exists in Bottelet DaybydayCRM through version 2.2.1 due to permissions being defined in the database seeder but not enforced within the controller logic. The 'Setting Handler' (SettingsController.php) only applies administrative middleware to the index view, leaving the updateOverall and updateFirstStep methods unprotected. Additionally, delete operations across Users, Clients, Tasks, Leads, Projects, and Offers controllers lack 'destroy' method permission checks. A remote authenticated attacker can exploit these flaws to modify global system configurations (VAT rates, currency, business hours) or perform unauthorized deletions of CRM resources. The issue is addressed in pull request #363 by enforcing middleware-based permission checks and implementing mass assignment protection.

## Affected products

- Bottelet DaybydayCRM up to 2.2.1

## Timeline

- 2026-03-04: disclosed: Vulnerability reported via GitHub issue #348
- 2026-04-08: patched: Fix merged in pull request #363
- 2026-06-01: advisory: CVE published and NVD record created

## References

- [https://github.com/Bottelet/DaybydayCRM/](https://github.com/Bottelet/DaybydayCRM/)
- [https://github.com/Bottelet/DaybydayCRM/issues/348](https://github.com/Bottelet/DaybydayCRM/issues/348)
- [https://github.com/Bottelet/DaybydayCRM/pull/363](https://github.com/Bottelet/DaybydayCRM/pull/363)
- [https://vuldb.com/cve/CVE-2026-10283](https://vuldb.com/cve/CVE-2026-10283)
- [https://vuldb.com/submit/825442](https://vuldb.com/submit/825442)
- [https://vuldb.com/submit/825443](https://vuldb.com/submit/825443)
- [https://vuldb.com/vuln/367576](https://vuldb.com/vuln/367576)

## Related threats

- [DaybydayCRM missing authorization in ProjectsController::updateAssign](https://junglewise.ai/threats/cve-2026-116008-daybydaycrm-through-2-2-1-contains-a-missing-authorization)
- [Bottelet DaybydayCRM improper authorization in DocumentsController](https://junglewise.ai/threats/cve-2026-10282-bottelet-daybydaycrm-improper-authorization-in)