CVE-2026-90806

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90806
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90806.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90806
Published
2026-09-14T17:30:08Z
Modified
2026-09-16T03:48:08Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization
Details

A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulk_views.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotely. Upgrading to version 1.3.0 is able to resolve this issue. The identifier of the patch is 799bb1210238f402c0c4948c8eedb6e61cd0c8d7. You should upgrade the affected component.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-862",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90806.json"
}
References

Affected packages

Git / github.com/django-crm/django-crm

Affected ranges

Type
GIT
Repo
https://github.com/django-crm/django-crm
Events
Introduced
b78226b5a35874df3cbf169df37144ff8ccf73c9
Fixed
799bb1210238f402c0c4948c8eedb6e61cd0c8d7
Fixed
edb93cfcd0b96369fdcaf878eb14d01f25362103
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.0"
        },
        {
            "last_affected": "1.0"
        },
        {
            "introduced": "1.1"
        },
        {
            "last_affected": "1.1"
        },
        {
            "introduced": "1.2"
        },
        {
            "last_affected": "1.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0
1.1
1.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90806.json"