CVE-2026-19966

MEDIUM 5.4

CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_contact of the component Contact Information Update. Such manipulation of the argument contact_id leads to authorization bypass. The attack can be launched remotely. The exploit is publicly available and might be used.

CWE	CWE-639 CWE-285
Vendor	codecanyon
Product	timecamp integration for crm
Published	Aug 17, 2026

Stay Ahead of the Next One

Get instant alerts for codecanyon timecamp integration for crm

Be the first to know when new medium vulnerabilities affecting codecanyon timecamp integration for crm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

CodeCanyon / TimeCamp Integration for CRM

2.0 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/391143 vuldb.com: https://vuldb.com/vuln/391143/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19966 vuldb.com: https://vuldb.com/submit/873105 github.com: https://github.com/4m3rr0r/PoCVulDb/issues/19

Credits

🔍 4m3rr0r (VulDB User)