CVE-2026-66028

The record

Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement to create conflicting account states where multiple accounts share the same email address with different passwords, resulting in unpredictable authentication behavior and unauthorized account access.

Affected packages

Related vulnerabilities

• CVE-2026-84296 Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software… CWE-303
• CVE-2026-86589 Incorrect implementation of authentication algorithm vulnerability in Apache Answer. CWE-303
• CVE-2026-83906 Incorrect implementation of authentication algorithm in Windows Shell allows an… CWE-303
• CVE-2026-9854 A vulnerability exists in SYS600 RBAC mechanism where users having access to the… CWE-303
• CVE-2026-9853 A vulnerability exists in SYS600 which allows any user authenticated to the operating… CWE-303
• CVE-2026-49467 Pingvin Share X is a secure and easy self-hosted file sharing platform. CWE-303
• CVE-2026-66411 DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in… CWE-303
• CVE-2026-11430 Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook… CWE-303