CVE-2026-90806 DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization
Remote attackers can modify case data without proper authorization due to missing checks in the bulk update view.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-90806?
CVE-2026-90806 is a medium-severity missing authorization vulnerability in DjangoCRM django-crm, published on 14 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulk_views.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotely. Upgrading to version 1.3.0 is able to resolve this issue. The identifier of the patch is 799bb1210238f402c0c4948c8eedb6e61cd0c8d7. You should upgrade the affected component.
Which versions are affected by CVE-2026-90806?
How do I fix CVE-2026-90806?
No fix has been published for CVE-2026-90806 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-90806 being exploited?
There is no known exploitation of CVE-2026-90806 in the wild and no public exploit code.
Sources
Also known as GHSA-3pwq-wqwf-8857.