ChangeWeDer CRM CVE-2026-92402

Q: What is the CVSS score of CVE-2026-92402?

CVE-2026-92402 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-80883 MEDIUM

Missing Authorization (CWE-862)

2026-09-16 VulDB

GHSA-6c3f-32hf-fq4p

Authentication Bypass Java Crm

5.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Remote endpoint reachable by any low-privilege authenticated user (PR:L), no interaction; a single missing-authZ endpoint yields limited read and tamper, so C/I/A all Low.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 17:29 vuln.today

DescriptionCVE.org

A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index of the file UserController.java of the component top.upstudy.crm.controller.UserController. The manipulation results in missing authorization. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Missing authorization in the ChangeWeDer CRM UserController index endpoint allows a remote attacker with a low-privilege authenticated account to reach functionality or data that should require stronger privileges, with limited confidentiality, integrity, and availability impact. The product has no versioning scheme and the project has not responded to the issue report, so no patched release is confirmed; exploitation requires network access to the Java CRM application and a valid low-privilege session. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires a low-privilege authenticated account on the ChangeWeDer CRM (PR:L) with network reachability to the application; the attacker then invokes the UserController 'index' endpoint, which lacks an authorization check (CWE-862). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a low-to-moderate real-world risk that maps well to its 5.3 CVSS 4.0 score, not an inflated high-severity item. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch identified at time of analysis; the upstream issue report at https://github.com/ChangeWeDer/crm/issues/3 has not been answered. … Detailed patch versions, workarounds, and compensating controls in full report.