CVE-2026-90806: DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization
A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotely. Upgrading to version 1.3.0 is able to resolve this issue. The identifier of the patch is 799bb1210238f402c0c4948c8eedb6e61cd0c8d7. You should upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesViewto a version that resolves this vulnerability.Fixed in 1.3.0Patch 799bb1210238f402c0c4948c8eedb6e61cd0c8d7
Event History
Frequently Asked Questions
Which deployments are affected?
DjangoCRM django-crm installations up to version 1.2 are affected in the Bulk Case Update component, specifically BulkUpdateCasesView in backend/cases/bulk_views.py.
What access does an attacker need to exploit this issue?
The issue can be exploited remotely and requires low privileges. No user interaction is required.
What is the remediation?
Upgrade DjangoCRM django-crm to version 1.3.0. The fix is identified by patch 799bb1210238f402c0c4948c8eedb6e61cd0c8d7.