Bottelet DaybydayCRM Missing Authentication Vulnerability in Settings Handler Component

A vulnerability exists in Bottelet DaybydayCRM versions prior to 2.2.1, where an unknown function in the Settings Handler component lacks proper authentication. This flaw allows for remote exploitation, as it enables unauthorized users to manipulate settings. Specifically, any authenticated employee can change critical company settings such as currency, VAT rates, and invoice numbering. Additionally, the absence of authorization checks on delete operations across various resource types allows users to delete clients, tasks, leads, projects, and more without permission.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in application settings and the deletion of important resources such as clients, tasks, and projects.

Remediation

Users are advised to update to DaybydayCRM version 2.2.1 or later, where this vulnerability has been addressed.