CVE-2026-92402
MediumCVSS 6.3Summary
A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the index function of the file UserController.java of the component top.upstudy.crm.controller.UserController. The manipulation results in missing authorization. The attack can be launched remotely. This product does not use versioning, so information about affected and unaffected releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Risk Assessment
An attacker can remotely access functionality without required authorization, potentially leading to unauthorized operations on user data. The lack of response from the project makes it difficult to assess the scope and availability of a fix.
Recommendation
Due to the lack of versioning and no response from the project, review the source code for authorization controls in UserController.java and implement your own fixes. Consider restricting access to the application from untrusted networks until the issue is resolved.
Other vulnerabilities in ChangeWeDer crm
See all- CVE-2026-92418Low
A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd affecting unknown code in src/main/resources/public/js/customerServe/customer.serve.js (Save Endpoint component). Manipulation of the customerName argument causes cross-site scripting, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-92401High
A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd, affecting top.upstudy.crm.utils.LoginUserUtil.releaseUserIdFromCookie, leading to improper authentication. The attack can be initiated remotely, and the project has not responded to the issue report.
Original NVD description (English source)
A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index of the file UserController.java of the component top.upstudy.crm.controller.UserController. The manipulation results in missing authorization. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.