Executive brief
Vtiger CRM, a popular open-source customer relationship management platform, contains a security vulnerability in its dashboard module. An attacker can trick a user into viewing a specially crafted link that injects unauthorized HTML content into the user's dashboard interface. This could be used to perform phishing attacks, deface the application for specific users, or potentially capture sensitive information by mimicking legitimate login forms or interface elements.
Technical details
A HTML injection vulnerability exists in Vtiger CRM 8.4.0 within the Dashboard module. The application fails to properly neutralize user-supplied input in the 'tabid' parameter of the DashBoardTab view during the 'getTabContents' action. This is a reflected-style vulnerability where the injected content is rendered in the victim's browser context. While classified as CWE-80 (Basic XSS), the primary impact described is the injection of arbitrary HTML. An attacker can exploit this by crafting a malicious URL and enticing a logged-in user to click it. Successful exploitation allows for the modification of the page DOM, which can be leveraged for credential harvesting via fake forms or session hijacking if script tags are successfully executed.
Affected products
- Vtiger Vtiger CRM 8.4.0
Timeline
- 2026-04-13: disclosed: Initial disclosure of CVE-2026-26460
- 2026-04-13: advisory: NVD publication date