Vulnerability · Published Sep 14, 2026 · Assigned by VulDB
CVE-2026-90806DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization
Medium 6.3
In plain English
A medium-severity missing authorization in django-crm from DjangoCRM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Official description
A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulk_views.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotely. Upgrading to version 1.3.0 is able to resolve this issue. The identifier of the patch is 799bb1210238f402c0c4948c8eedb6e61cd0c8d7. You should upgrade the affected component.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| DjangoCRM | django-crm | 1.01.11.2 |
Weakness: CWE-862, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
References
- VDB-403308 | DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization vdb-entry, technical-description
- VDB-403308 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-90806 | CVE Analysis and Report third-party-advisory
- Submit #920489 | Django-CRM master Missing Authorization third-party-advisory
- https://github.com/Django-CRM/Django-CRM/issues/745 issue-tracking
- https://github.com/Django-CRM/Django-CRM/pull/746 issue-tracking, patch
- https://github.com/Django-CRM/Django-CRM/commit/799bb1210238f402c0c4948c8eedb6e61cd0c8d7 patch
- https://github.com/Django-CRM/Django-CRM/releases/tag/v1.3.0 patch