CVE-2026-90806
Received Received - Intake

Missing Authorization in DjangoCRM Bulk Case Update

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulk_views.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotely. Upgrading to version 1.3.0 is able to resolve this issue. The identifier of the patch is 799bb1210238f402c0c4948c8eedb6e61cd0c8d7. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90806
EUVD
EUVD-2026-77695

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
django_crm django_crm to 1.2 (inc)
django_crm django_crm 1.3.0
django_crm django_crm to 1.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization issue in DjangoCRM django-crm versions up to 1.2. It affects the BulkUpdateCasesView function in backend/cases/bulk_views.py, allowing remote attackers to perform unauthorized bulk case updates. The issue is resolved by upgrading to version 1.3.0.

Detection Guidance

Detection involves checking for the vulnerable version of django-crm. Use commands like pip show django-crm or grep -r 'django-crm' in your project directory to identify the installed version.

Impact Analysis

An attacker could exploit this to modify case data without proper authorization, potentially leading to data corruption, unauthorized access to sensitive information, or disruption of normal operations. The impact depends on the system's use of the affected component.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Compliance may be compromised if sensitive data is exposed or altered without authorization.

Mitigation Strategies

Upgrade django-crm to version 1.3.0 or later immediately. Use pip install --upgrade django-crm==1.3.0 or follow your package manager's update procedure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90806. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart