CVE-2026-19966: CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization
A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/savecontact of the component Contact Information Update. Such manipulation of the argument contactid leads to authorization bypass. The attack can be launched remotely. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CodeCanyon TimeCamp Integration for CRMto a version that resolves this vulnerability.Fixed in 2.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19966?
The severity of CVE-2026-19966 is medium, with a score of 5.4.
How does CVE-2026-19966 affect the CodeCanyon TimeCamp Integration for CRM?
CVE-2026-19966 allows for an authorization bypass through manipulation of the contact_id in the save_contact file.
What versions of the software are impacted by CVE-2026-19966?
CVE-2026-19966 affects CodeCanyon TimeCamp Integration for CRM versions up to 2.8.
How can I remediate CVE-2026-19966?
To remediate CVE-2026-19966, upgrade the CodeCanyon TimeCamp Integration for CRM to a version beyond 2.8.
What kind of access does CVE-2026-19966 exploit?
CVE-2026-19966 exploits the ability to bypass authorization, potentially allowing unauthorized users to update contact information.