CVE-2026-92402

MEDIUM 6.3

ChangeWeDer crm top.upstudy.crm.controller.UserController UserController.java index authorization

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index of the file UserController.java of the component top.upstudy.crm.controller.UserController. The manipulation results in missing authorization. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-862 CWE-863
Vendor	changeweder
Product	crm
Published	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for changeweder crm

Be the first to know when new medium vulnerabilities affecting changeweder crm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

ChangeWeDer / crm

c07bd4c97141521af6475034bc58523beed51bbd

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/405553 vuldb.com: https://vuldb.com/vuln/405553/cti vuldb.com: https://vuldb.com/cve/CVE-2026-92402 vuldb.com: https://vuldb.com/submit/940349 github.com: https://github.com/ChangeWeDer/crm/issues/3 github.com: https://github.com/ChangeWeDer/crm/

Credits

🔍 mjh_123 (VulDB User) VulDB CNA Team