CVE-2026-92401— ChangeWeDer crm improper authentication
Quick assessment
Affected
ChangeWeDer crm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 ChangeWeDer crm 中（截至 commit c07bd4c97141521af6475034bc58523beed51bbd）发现一个安全漏洞。该漏洞影响函数 。由于对该函数的不当操作会导致认证机制失效（improper authentication）。攻击者可远程发起攻击。由于该产品采用持续交付（Continuous Delivery）和滚动发布（rolling releases）模式，因此没有具体的受影响版本或已修复版本的详细信息。项目组已通过问题报告提前获知此问题，但截至目前尚未做出回应。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92401
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ChangeWeDer crm improper authentication
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects the function top.upstudy.crm.utils.LoginUserUtil.releaseUserIdFromCookie. The manipulation leads to improper authentication. The attack can be initiated remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ChangeWeDer | crm | c07bd4c97141521af6475034bc58523beed51bbd |
cpe:2.3:a:changeweder:crm:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-92401
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92401
请登录查看更多情报信息。
Other References for CVE-2026-92401 (2)
-
ChangeWeDer 存在任意身份伪造漏洞 · Issue #2 · ChangeWeDer/crm issue-tracking
Same Patch Batch · ChangeWeDer · 2026-09-16 · 3 CVEs total
| CVE-2026-92402 | 6.3 MEDIUM | ChangeWeDer crm top.upstudy.crm.controller.UserController UserController.java index author |
| CVE-2026-92418 | 3.5 LOW | ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting |
IV. Related Vulnerabilities
Same product: crm
-
CVE-2026-92418
ChangeWeDer crm Save Endpoint customer.serve.js cross site s -
CVE-2026-92402
ChangeWeDer crm top.upstudy.crm.controller.UserController Us -
CVE-2026-86172
DefaultFuction CRM delete.php sql injection -
CVE-2026-86171
DefaultFuction CRM delete.php sql injection -
CVE-2026-86170
DefaultFuction CRM edit.php sql injection
Same weakness: CWE-287
-
CVE-2026-19607
Keycloak-services: keycloak-services: broker-originated user -
CVE-2025-43936
Dell ObjectScale 4.4.0前认证不当漏洞 -
CVE-2026-76187
Apache Airflow Keycloak provider: Any realm client's credent -
CVE-2026-81237
Dell Wyse Management Suite <2605.0.3.683 认证缺陷 -
CVE-2026-54547
Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Op
V. Comments for CVE-2026-92401
No comments yet