CVE-2026-10282

MediumCVSS 4.3

Published: 01/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

In Bottelet DaybydayCRM up to 2.2.1, an improper authorization vulnerability was found in the view function in app/Http/Controllers/DocumentsController.php. The attack can be performed remotely. A patch is recommended.

Risk Assessment

An attacker can remotely gain unauthorized access to documents, potentially leading to leakage of sensitive information.

Recommendation

Immediately apply the available patch or update the system to the latest version.

Other vulnerabilities in Bottelet DaybydayCRM

CVE-2026-10283Medium
Vulnerability in Bottelet DaybydayCRM up to 2.2.1. An unknown function in the Setting Handler component allows missing authentication. Remote exploitation is possible.

Original NVD description (English source)

A security vulnerability has been detected in Bottelet DaybydayCRM up to 2.2.1. This impacts the function view of the file app/Http/Controllers/DocumentsController.php. Such manipulation leads to improper authorization. The attack may be launched remotely. It is best practice to apply a patch to resolve this issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS