CVE-2026-66028

Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement to create conflicting account states where multiple accounts share the same email address with different passwords, resulting in unpredictable authentication behavior and unauthorized account access.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://codecanyon.net/item/ekushey-project-manager-crm/9492104
https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-66028
https://www.vulncheck.com/advisories/ekushey-project-manager-crm-missing-uniqueness-constraint-via-client-email

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Ekushey Project Manager CRM hasta la versión 5.0 contiene una vulnerabilidad de restricción de unicidad faltante que permite a los administradores autenticados crear cuentas de cliente duplicadas con credenciales idénticas de correo electrónico y contraseña. Los atacantes pueden explotar la falta de aplicación de unicidad del campo de correo electrónico para crear estados de cuenta conflictivos donde múltiples cuentas comparten la misma dirección de correo electrónico con diferentes contraseñas, lo que resulta en un comportamiento de autenticación impredecible y acceso no autorizado a la cuenta.

Information

Published : 2026-07-27 18:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-66028

Mitre link : CVE-2026-66028

CVE.ORG link : CVE-2026-66028

JSON object : View

Products Affected

No product.

CWE

CWE-303

Incorrect Implementation of Authentication Algorithm

{"id": "CVE-2026-66028", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66028", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T18:24:50.620701Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 5.5, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Creativeitem", "product": "Ekushey Project Manager CRM", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "5.0"}], "defaultStatus": "affected"}]}], "published": "2026-07-27T18:17:00.090", "references": [{"url": "https://codecanyon.net/item/ekushey-project-manager-crm/9492104", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-66028", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/ekushey-project-manager-crm-missing-uniqueness-constraint-via-client-email", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-303"}]}], "descriptions": [{"lang": "en", "value": "Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement to create conflicting account states where multiple accounts share the same email address with different passwords, resulting in unpredictable authentication behavior and unauthorized account access."}, {"lang": "es", "value": "Ekushey Project Manager CRM hasta la versi\u00f3n 5.0 contiene una vulnerabilidad de restricci\u00f3n de unicidad faltante que permite a los administradores autenticados crear cuentas de cliente duplicadas con credenciales id\u00e9nticas de correo electr\u00f3nico y contrase\u00f1a. Los atacantes pueden explotar la falta de aplicaci\u00f3n de unicidad del campo de correo electr\u00f3nico para crear estados de cuenta conflictivos donde m\u00faltiples cuentas comparten la misma direcci\u00f3n de correo electr\u00f3nico con diferentes contrase\u00f1as, lo que resulta en un comportamiento de autenticaci\u00f3n impredecible y acceso no autorizado a la cuenta."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "disclosure@vulncheck.com"}