CVE-2026-19966
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to version 2.8. This issue affects some unknown processing of the file /clients/save_contact of the Contact Information Update component. Manipulation of the argument contact_id leads to authorization bypass. The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
The risk includes unauthorized access to contact update functionality, which could lead to data confidentiality breaches or unauthorized modifications.
Recommendation
It is recommended to restrict access to the /clients/save_contact file and apply vendor patches if available.
Original NVD description (English source)
A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_contact of the component Contact Information Update. Such manipulation of the argument contact_id leads to authorization bypass. The attack can be launched remotely. The exploit is publicly available and might be used.