CVE-2026-116008: DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign
DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{externalid} with a chosen userassignedid to redirect project ownership and notifications.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated DaybydayCRM user, including a low-privileged employee, can exploit it. The attacker does not need the can-assign-new-user-to-project permission.
What does an attacker need to send?
The attacker needs to send a PATCH or POST request to /projects/updateassign/{external_id} and supply a chosen user_assigned_id. This can reassign a project and redirect its ownership and notifications.
Are unauthenticated users affected?
The available information indicates authentication is required. It does not describe exploitation by unauthenticated users.
How can administrators look for exploitation?
Review PATCH and POST requests to /projects/updateassign/{external_id}, especially assignments made by users without the can-assign-new-user-to-project permission. Check for unexpected changes to project ownership or notification recipients.