CVE-2026-92401
HighCVSS 7.3Summary
A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd, affecting top.upstudy.crm.utils.LoginUserUtil.releaseUserIdFromCookie, leading to improper authentication. The attack can be initiated remotely, and the project has not responded to the issue report.
Risk Assessment
Improper authentication may allow an attacker to bypass access controls and hijack a user session or identity. The project's lack of response makes it hard to assess scope and patch availability.
Recommendation
Given the lack of a fix, consider implementing your own safeguards such as additional session verification and access restrictions. Monitor the project for updates and evaluate an alternative CRM solution.
Other vulnerabilities in ChangeWeDer crm
See all- CVE-2026-92418Low
A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd affecting unknown code in src/main/resources/public/js/customerServe/customer.serve.js (Save Endpoint component). Manipulation of the customerName argument causes cross-site scripting, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-92402Medium
A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the index function of the file UserController.java of the component top.upstudy.crm.controller.UserController. The manipulation results in missing authorization. The attack can be launched remotely. This product does not use versioning, so information about affected and unaffected releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects the function top.upstudy.crm.utils.LoginUserUtil.releaseUserIdFromCookie. The manipulation leads to improper authentication. The attack can be initiated remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.