BottleCRM EUVD-2026-101222

Requires an authenticated organization administrator account (PR:H) with the ability to create case routing rules; the malicious payload is a regex pattern in a routing rule condition that is evaluated by _match_condition() in cases/routing.py during case saves. Exploitation is limited by this administrative privilege requirement and by the routing-rules feature being in use, but it needs no user interaction and works against default configurations once a routing rule can be created. The key aggravating condition is architectural: worker processes are shared across all tenants, so the impact of a single tenant admin extends to unrelated tenants.

This is a moderate-severity availability issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VA:H, all confidentiality and integrity metrics N) correctly frames it: network-reachable and low-complexity, but gated behind PR:H - the attacker must already be an authenticated organization administrator. The score of 6.9 is driven almost entirely by the availability impact amplified by the multi-tenant blast radius (workers are shared across all tenants). No EPSS score, KEV listing, or explicit proof-of-concept was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore an insider or compromised-admin-account scenario rather than mass opportunistic exploitation: the privilege barrier sharply limits who can trigger it, but the cross-tenant impact means one malicious or compromised tenant admin can degrade service for unrelated tenants, which is the genuinely concerning dimension. Note a data discrepancy to verify: the product is identified as micropyramid:bottlecrm, yet all references point to the Django-CRM/Django-CRM GitHub repository - confirm with the vendor which product/codebase is actually affected.

An authenticated organization administrator (or an attacker who has compromised such an account) logs into the CRM and creates a case routing rule whose condition uses a crafted regular expression designed for catastrophic backtracking. When any case save subsequently evaluates that rule via _match_condition(), the regex engine consumes a worker indefinitely; repeating this exhausts the worker pool. Because workers are shared across all tenants, the denial of service spreads beyond the attacker's own organization. No public exploit code was provided in the input.