CVE-2026-66028 - Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email

A GitHub repository version of this disclosure can be read here: CVE-2026-66028.

Description

Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement to create conflicting account states where multiple accounts share the same email address with different passwords, resulting in unpredictable authentication behavior and unauthorized account access.

Proof-of-Concept

1. On a default installation, an existing Client user (Client) exists with the email client@example.com and password 1234. Log in as an Administrator, navigate to Manage Client, and click Add New Client. Create a new account named Client2 using the identical email (client@example.com) and password (1234).

2. Log out of the Administrator account and attempt to log in using client@example.com and 1234. The application authenticates exclusively as Client2. The original Client account is completely shadowed and rendered inaccessible.

3. Delete the Client2 account via Manage Client, recreate Client2 with the exact same details (client@example.com / 1234), and log in again. The authentication route now resolves exclusively to the original Client account instead. The Client2 account remains active in the database with valid credentials, but is rendered completely unreachable.

4. This vulnerability stems from a missing UNIQUE database constraint on the client email field combined with authentication queries that match both email and password simultaneously (e.g., WHERE email = ? AND password = ?). If Client2 updates their password to a unique value (e.g., 12345), both accounts can log in using client@example.com. The system routes the login to Client when 1234 is provided, and to Client2 when 12345 is provided, demonstrating that user identity is bound to the credential combination rather than a unique primary key or identity identifier.

Timeline

• 23 July 2026: This vulnerability in Ekushey Project Manager CRM v5.0 was initially discovered using their live demo instance.
• 24 July 2026: I submitted a complete report to VulnCheck.
• 25 July 2026: Following an initial triage, VulnCheck confirmed they were unable to locate a security reporting mechanism for Creativeitem. Consequently, they supported the decision to proceed with public disclosure and reserved a CVE ID for this vulnerability.
• 26 July 2026: I published a public disclosure in my CVE-Disclosures repository on GitHub.
• 27 July 2026: VulnCheck then officially published CVE-2026-66028.
• 28 July 2026: I published this blog post.