BottleCRM CVE-2026-110595

Exploitation requires an authenticated account that additionally holds the application's 'mass-import' permission; this is the key limiting factor and rules out anonymous or ordinary low-privilege users. The attacker must send oversized CSV files (larger than the intended 5 MB limit) to the specific /api/contacts/import/ and /api/cases/import/ endpoints, and must send them concurrently to outpace memory reclamation and actually exhaust worker memory. No special non-default product configuration is needed beyond having the import feature available and the privileged permission granted; impact is limited to availability (worker OOM) with no data exposure or modification.

This is a medium-severity availability-only issue, not an urgent priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reachability with low attack complexity and no user interaction, but exploitation requires PR:L - an authenticated account that also holds the application-specific 'mass-import' permission - and the only impact is VA:L (limited availability loss via worker out-of-memory). There is no confidentiality or integrity impact (VC:N/VI:N). No EPSS score was provided, the CVE is not on CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis; all signals point to a low-likelihood, limited-blast-radius denial-of-service rather than a widely weaponized flaw. The signals are internally consistent (CWE-770 uncontrolled resource allocation matches the description and the availability-only vector), so no conflict needs flagging - the main caveat is product-identity ambiguity noted below rather than risk-signal disagreement. Realistic risk is confined to environments that grant import permissions to semi-trusted users; a malicious insider or a compromised low-privilege account could degrade service, but external unauthenticated mass exploitation is not possible.

An authenticated user (or attacker using stolen credentials) who holds the mass-import permission repeatedly uploads CSV files larger than the 5 MB limit to /api/contacts/import/ and /api/cases/import/, sending many concurrently. Because _read_upload() reads the entire file into memory before the size check is enforced, the worker processes allocate memory faster than the limit can reject them, exhausting RAM and triggering out-of-memory termination that disrupts service for other users. No public proof-of-concept is referenced, so exploitation would require an attacker to craft the oversized-upload flooding themselves.