EUVD-2026-89339

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember that grants...

CVE-2026-61519

Liberu CRM versions prior to 10.0.0 are susceptible to a broken access control vulnerability within the TeamPolicy::addTeamMember() function. The root cause is a flawed authorization predicate that grants invitation rights based solely on a pending invitation email match, failing to validate priv...