Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92401— ChangeWeDer crm improper authentication

Quick assessment

Affected
ChangeWeDer crm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 ChangeWeDer crm 中（截至 commit c07bd4c97141521af6475034bc58523beed51bbd）发现一个安全漏洞。该漏洞影响函数 。由于对该函数的不当操作会导致认证机制失效（improper authentication）。攻击者可远程发起攻击。由于该产品采用持续交付（Continuous Delivery）和滚动发布（rolling releases）模式，因此没有具体的受影响版本或已修复版本的详细信息。项目组已通过问题报告提前获知此问题，但截至目前尚未做出回应。

CVSS 7.3 · High EPSS 0.69% · P53

Affected Version Matrix 1

VendorProduct Version RangeStatus
ChangeWeDer crm c07bd4c97141521af6475034bc58523beed51bbd affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92401

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ChangeWeDer crm improper authentication
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects the function top.upstudy.crm.utils.LoginUserUtil.releaseUserIdFromCookie. The manipulation leads to improper authentication. The attack can be initiated remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ChangeWeDer crm c07bd4c97141521af6475034bc58523beed51bbd cpe:2.3:a:changeweder:crm:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-92401

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92401

请登录查看更多情报信息。

Other References for CVE-2026-92401 (2)

Same Patch Batch · ChangeWeDer · 2026-09-16 · 3 CVEs total

CVE-2026-92402 6.3 MEDIUM ChangeWeDer crm top.upstudy.crm.controller.UserController UserController.java index author
CVE-2026-92418 3.5 LOW ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting

IV. Related Vulnerabilities

Same product: crm
Same vendor: ChangeWeDer
Same weakness: CWE-287