Missing Authorization in DjangoCRM Bulk Case Update Functionality
CVE-2026-90806

5.3MEDIUM

Key Information:

Vendor

Djangocrm

Status
Django-crm
Vendor
CVE Published:
14 September 2026

What is CVE-2026-90806?

A significant vulnerability exists in the DjangoCRM application affecting versions up to 1.2, specifically in the Bulk Update Cases functionality. This issue arises from inadequate authorization checks in the backend/cases/bulk_views.py file, leading to a potential risk where unauthorized users could manipulate bulk case updates remotely. To eliminate this risk, it is crucial for users to upgrade to version 1.3.0, which includes a patch addressing these authorization flaws. Users are advised to review their implementations to ensure compliance with security best practices.

Affected Version(s)

django-crm 1.0

django-crm 1.1

django-crm 1.2

References

https://vuldb.com/vuln/403308
vdb-entrytechnical-description
https://vuldb.com/vuln/403308/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-90806
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Customer (VulDB User)
.