MEDIUM

CVE-2026-90806

2026-09-14 CVSS v3.1

CVSS

6.3

Description

A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulk_views.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotely. Upgrading to version 1.3.0 is able to resolve this issue. The identifier of the patch is 799bb1210238f402c0c4948c8eedb6e61cd0c8d7. You should upgrade the affected component.

Weakness (CWE)

CWE-862 Missing Authorization

CWE-863 Incorrect Authorization

EPSS Score

0.36%

Probability of exploitation in next 30 days

29.6th percentile

References

https://github.com/Django-CRM/Django-CRM/commit/799bb1210238f402c0c4948c8eedb6e61cd0c8d7 https://github.com/Django-CRM/Django-CRM/issues/745 https://github.com/Django-CRM/Django-CRM/pull/746 https://github.com/Django-CRM/Django-CRM/releases/tag/v1.3.0 https://vuldb.com/cve/CVE-2026-90806 https://vuldb.com/submit/920489 https://vuldb.com/vuln/403308 https://vuldb.com/vuln/403308/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE