TI-2026-61709 Aliases CVE-2026-90806 GHSA-3pwq-wqwf-8857

DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization

LOW 24CWE-862Published 2026-09-14 · Updated 2026-09-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulk_views.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotely. Upgrading to version 1.3.0 is able to resolve this issue. The identifier of the patch is 799bb1210238f402c0c4948c8eedb6e61cd0c8d7. You should upgrade the affected component.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00374 31st percentileScored 2026-11-07

Fix Fixed django-crm (DjangoCRM): 1.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
DjangoCRM	django-crm	1.0; 1.1; 1.2	1.3.0	Patch available	CNA

django-crm VendorDjangoCRM Affected 1.0; 1.1; 1.2 Fixed in 1.3.0 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:djangocrm:django-crm::::::::	—	—	DjangoCRM

cpe:2.3:a:djangocrm:django-crm:*:*:*:*:*:*:*:* Versions — — ·DjangoCRM

Remediation

Fix · CNA django-crm (DjangoCRM) Fixed in 1.3.0

Timeline

2026-10-02 Threatist record created from CVE-2026-90806
2026-10-03 Alias added: GHSA-3pwq-wqwf-8857

References

Patch 3

Other 1

https://github.com/Django-CRM/Django-CRM/issues/745

TI-2026-49909 DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery CVSS 3.1CRITICAL 9.1
TI-2026-49910 DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering CVSS 3.1HIGH 8.1
TI-2026-49911 DjangoCRM - Unauthenticated Open Redirect via toggle_default_sorting next_url Parameter CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences