CVE-2026-92402: ChangeWeDer crm top.upstudy.crm.controller.UserController UserController.java index authorization
A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index of the file UserController.java of the component top.upstudy.crm.controller.UserController. The manipulation results in missing authorization. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is remotely exploitable, but the published vector indicates that an attacker needs low-level privileges. No user interaction is required.
What security impact can successful exploitation have?
Successful exploitation can affect confidentiality, integrity, and availability at a low impact level. The underlying issue is missing authorization in the UserController index function.
How can I determine whether my deployment is affected?
Affected and unaffected releases cannot be identified by version because ChangeWeDer crm does not use versioning. The issue is reported to affect code up to commit c07bd4c97141521af6475034bc58523beed51bbd, so compare your UserController.java implementation, particularly the index function, with the remediation status of that code.
Is a vendor fix available?
The project was notified through an issue report but had not responded at the time of publication. No fixed release or vendor-provided remediation is identified in the available information.