CVE-2026-7782: Perfex CRM Auth Bypass Vulnerability

CVE-2026-7782 Overview

CVE-2026-7782 is an authorization bypass vulnerability in CodeCanyon Perfex CRM versions up to 3.4.1. The flaw resides in the Clients::project function within application/controllers/Clients.php, part of the Tenant Handler component. An authenticated remote attacker can manipulate the ID argument to access project data belonging to other tenants. The issue is classified under [CWE-285] Improper Authorization. Public exploit details are available, increasing the risk of opportunistic abuse against multi-tenant Perfex CRM deployments.

Critical Impact
Authenticated remote attackers can break cross-tenant boundaries on project discussion comments, exposing confidential client project data across tenants.

Affected Products

CodeCanyon Perfex CRM 3.4.0
CodeCanyon Perfex CRM 3.4.1
All Perfex CRM versions up to and including 3.4.1

Discovery Timeline

2026-05-04 - CVE-2026-7782 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7782

Vulnerability Analysis

The vulnerability stems from missing authorization checks in the Clients::project controller method. Perfex CRM is a multi-tenant customer relationship management application. Each tenant should only access projects, discussions, and comments belonging to its own organization. The project action accepts an ID parameter that identifies the target project record. The controller loads the requested project without verifying that the authenticated user's tenant owns the resource. As a result, an attacker who holds valid credentials in one tenant can request another tenant's project ID and read its discussion comments. The defect maps to broken access control on horizontal authorization boundaries.

Root Cause

The controller relies on authentication state alone to gate access. It does not enforce a tenant-to-resource ownership check before returning project discussion data. Direct object references in the ID argument become an Insecure Direct Object Reference, allowing predictable enumeration of project identifiers across tenants.

Attack Vector

The attack is performed remotely over the network by a low-privileged authenticated user. The attacker sends crafted HTTP requests to the Clients::project endpoint with another tenant's project ID. No user interaction is required. According to the public technical write-up referenced by Bytium Insight on Perfex CRM, the attacker retrieves project discussion comments outside their tenant scope. Additional context is available at VulDB Vulnerability #360979.

No verified proof-of-concept code is published in the structured references. Refer to the linked advisories for request-level reproduction details.

Detection Methods for CVE-2026-7782

Indicators of Compromise

HTTP requests to /clients/project/<ID> where the ID value does not belong to the authenticated user's tenant.
Sequential or enumerated access to project IDs from a single user session.
Unexpected reads of project discussion comments shortly after low-privilege account logins.

Detection Strategies

Correlate web server access logs with application audit logs to flag project reads where the requesting user's tenant ID does not match the project's tenant ID.
Baseline normal project access patterns per user and alert on deviations such as access to many distinct project IDs in short windows.
Inspect referrer and session data for direct URL access to Clients::project outside the user's normal navigation paths.

Monitoring Recommendations

Forward Perfex CRM application and PHP error logs to a central SIEM for cross-tenant query analysis.
Enable verbose request logging on the application/controllers/Clients.php route during incident review.
Track authentication events alongside data access events to attribute cross-tenant reads to specific accounts.

How to Mitigate CVE-2026-7782

Immediate Actions Required

Restrict access to the Perfex CRM administrative and client portals to trusted networks until a patched release is deployed.
Audit recent project discussion access logs for cross-tenant ID enumeration and notify affected tenants if exposure is found.
Rotate credentials for any accounts suspected of probing project IDs outside their tenant scope.

Patch Information

No vendor patch is referenced in the available CVE data. Monitor the CodeCanyon Perfex CRM vendor channel for an update beyond version 3.4.1 that addresses the Clients::project authorization check. Track VulDB Vulnerability #360979 for remediation status.

Workarounds

Add a server-side authorization check in application/controllers/Clients.php that validates the authenticated user's tenant against the requested project's tenant before returning data.
Deploy a web application firewall rule that inspects requests to the Clients::project action and blocks responses when the session tenant does not match the requested project ID.
Reduce the number of low-privilege client accounts and disable inactive tenants to shrink the authenticated attack surface.

bash

# Example WAF logic (pseudocode) to enforce tenant binding
# Block requests to Clients::project where session tenant != project tenant
location ~ ^/clients/project/([0-9]+)$ {
    access_by_lua_block {
        local project_id = ngx.var[1]
        local session_tenant = ngx.var.cookie_tenant_id
        if not enforce_tenant_match(session_tenant, project_id) then
            ngx.exit(403)
        end
    }
}