CVE-2026-24595
Missing Authorization in Zoho CRM Lead Magnet Allows Unauthorized Access
Publication date: 2026-01-23
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zoho | zoho_crm_lead_magnet | From 1.0.0 (inc) to 1.8.1.5 (inc) |
| unknown_vendor | zoho_crm_forms | to 1.8.1.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-24595 is a Broken Access Control vulnerability in the WordPress Zoho CRM Lead Magnet Plugin (versions up to 1.8.1.5). It occurs due to missing authorization, authentication, or nonce token checks in certain plugin functions, which may allow unprivileged users (such as subscribers) to perform actions that should be restricted to higher-privileged roles (like developers). This vulnerability falls under the OWASP Top 10 category A1: Broken Access Control. [1]
How can this vulnerability impact me? :
This vulnerability could allow users with low privileges to execute actions reserved for higher-privileged users, potentially leading to unauthorized access or modification of data within the Zoho CRM Lead Magnet plugin. However, the risk is considered minimal due to its low severity (CVSS score 5.4) and limited exploitability. No official patch is currently available, but mitigation services exist to provide protection. [1]
What immediate steps should I take to mitigate this vulnerability?
Since there is no official fix or patched version currently available for this vulnerability, it is recommended to use mitigation services such as those offered by Patchstack to provide rapid protection. Additionally, review and restrict user roles and permissions to limit unprivileged users from performing actions reserved for higher-privileged roles. Monitoring and applying strict access control policies can help reduce risk until an official patch is released. [1]