Executive brief
Django-CRM is a customer relationship management system used to manage sales cases and client interactions. The bulk case update feature fails to properly validate user permissions before modifying cases, allowing any organization member to modify cases they shouldn't have access to, self-assign cases, and bypass approval rules. This enables unauthorized access to sensitive customer data and workflow circumvention.
Technical details
The BulkUpdateCasesView in backend/cases/bulk_views.py implements a missing authorization vulnerability (CWE-862). The view accepts user-supplied case IDs and field updates but filters cases only by organization membership without calling the required assert_case_write_access function. Unlike the single-case update endpoint (CaseDetailView.put), the bulk endpoint directly saves case modifications via Model.save(), bypassing serializer validation that enforces approval rules for status transitions. An authenticated user in an organization can make POST requests to /api/cases/bulk/update/ with arbitrary case IDs and field values to modify any case in their organization, self-assign cases, and transition cases to closed status without required approvals. The vulnerability affects versions up to 1.2; patched in version 1.3.0 (commit 799bb1210238f402c0c4948c8eedb6e61cd0c8d7).
Affected products
- Django-CRM Django-CRM up to 1.2
Timeline
- 2026-09-14: disclosed: CVE-2026-90806 published
- 2026-08-12: patched: Fix merged in commit 799bb1210238f402c0c4948c8eedb6e61cd0c8d7 for version 1.3.0