FeelCRM OS CVE-2026-105291

Exploitation requires an attacker to deliver a crafted URL targeting the Department Search Endpoint with a malicious payload in the 'keyword' GET/POST argument processed by GroupController::index, and requires a victim user to interact by visiting that link (CVSS UI:P). It affects feelcrm-os 1.0.0 specifically. The primary limiting factor is the mandatory user interaction and the fact that impact is confined to script execution in the victim's browser context (VI:L, no server-side confidentiality or availability impact); value is highest when the victim holds an authenticated CRM session whose cookies or actions the injected script can abuse.

This is a low-severity reflected cross-site scripting flaw (CWE-79) with a vendor CVSS 4.0 base score of 2.1, and all available signals agree that real-world priority is low. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) indicates a network-reachable, low-complexity issue requiring no privileges but requiring user interaction (UI:P), with only a limited integrity impact and no confidentiality or availability impact - consistent with script injection via a reflected parameter rather than server compromise. Publicly available exploit code exists (a GitHub issue report), but this is NOT active exploitation: the CVE is not listed in CISA KEV and no EPSS score was provided, so exploitation probability cannot be quantified from the input. The signals are internally consistent - low CVSS, POC-but-no-KEV, and an obscure affected product all point to a low-urgency, opportunistic issue rather than a widespread or targeted threat. No EPSS score and no KEV status are present in the data; absence of these is noted but is not itself a contradiction. Note also that the vendor has not responded to the early issue report, so no official patch is confirmed.

An attacker crafts a URL to the Department Search Endpoint with a malicious payload in the 'keyword' argument and lures an authenticated CRM user into clicking it. When the GroupController::index function reflects the unsanitized keyword into the response, the attacker's script executes in the victim's browser session, potentially stealing session tokens or performing actions as that user. Publicly available exploit code (via the project's GitHub issue) lowers the barrier to reproduction.