CyberRota Analysis
AI-GeneratedLiberu CRM versions prior to 10.0.0 are vulnerable to a broken access control issue that allows users with pending team invitations to invite additional accounts with elevated privileges. This flaw enables attackers to exploit the system by sending a crafted POST request, granting full admin access to unauthorized accounts upon invitation acceptance. Organizations using affected versions should prioritize patching this vulnerability to prevent potential unauthorized access and data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invitation rights based solely on the existence of a pending invitation email match. Attackers can send a POST request to the team-invitations route specifying the admin role for a second account, bypassing privilege-level validation in InviteTeamMember, causing the second account upon invitation acceptance to be attached to the team with full admin-level create, read, update, and delete access over all team-scoped data.