Vulnerability · Published Sep 16, 2026 · Assigned by VulDB

CVE-2026-92401ChangeWeDer crm improper authentication

High 7.3

In plain English

A high-severity improper authentication in crm from ChangeWeDer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.7%top 47.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects the function top.upstudy.crm.utils.LoginUserUtil.releaseUserIdFromCookie. The manipulation leads to improper authentication. The attack can be initiated remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
ChangeWeDer	crm	c07bd4c97141521af6475034bc58523beed51bbd

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

References

VDB-405552 | ChangeWeDer crm improper authentication vdb-entry, technical-description
VDB-405552 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-92401 | CVE Analysis and Report third-party-advisory
Submit #940347 | ChangeWeDer crm — CRM Customer Management System 0.0.1-SNAPSHOT Authentication Bypass Issues third-party-advisory
https://github.com/ChangeWeDer/crm/issues/2 issue-tracking
https://github.com/ChangeWeDer/crm/ product