Description
A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_contact of the component Contact Information Update. Such manipulation of the argument contact_id leads to authorization bypass. The attack can be launched remotely. The exploit is publicly available and might be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CodeCanyon | TimeCamp Integration for CRM | 2.0, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8 | — |
References
- VDB-391143 | CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization vdb-entry technical-description
- VDB-391143 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-19966 | CVE Analysis and Report third-party-advisory
- Submit #873105 | CodenPlug TimeCamp Integration for RISE CRM v2.8 Access Control third-party-advisory
- https://github.com/4m3rr0r/PoCVulDb/issues/19 exploit issue-tracking