PT-2026-45503 · Bottelet+1 · Daybyday Crm

Mitchell45 · CVE-2026-10282 · Published 2026-06-01 · Updated 2026-06-01

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X

Name of the Vulnerable Software and Affected Versions Bottelet DaybydayCRM versions prior to 2.2.2

Description An improper authorization issue exists that can be exploited remotely. The flaw is located within the view() function of the app/Http/Controllers/DocumentsController.php file.

Recommendations Apply the security patch for versions prior to 2.2.2. As a temporary mitigation, restrict access to the view() function in the app/Http/Controllers/DocumentsController.php file.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2026-10282

Affected Products

Daybyday Crm

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10282.json · Exploit
• https://github.com/Bottelet/DaybydayCRM/pull/362 · Patch
• https://osv.dev/vulnerability/CVE-2026-10282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-10282 · Security Note
• https://github.com/Bottelet/DaybydayCRM/issues/347 · Note
• https://vuldb.com/submit/825439 · Note
• https://vuldb.com/submit/825440 · Note
• https://vuldb.com/vuln/367575/cti · Note
• https://vuldb.com/vuln/367575 · Note
• https://github.com/Bottelet/DaybydayCRM · Note
• https://vuldb.com/cve/CVE-2026-10282 · Note