Is CVE-2026-92401 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92401 being exploited in the wild.

How severe is CVE-2026-92401?

High severity, with a CVSS score of 7.3, published 16 September 2026.

Which products and versions are affected?

ChangeWeDer CRM up to c07bd4c97141521af6475034bc58523beed51bbd.

Is there a fix for CVE-2026-92401?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92401 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92401?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92401: ChangeWeDer CRM improper authentication in cookie validation

CVE-2026-92401 · Severity: high · CVSS 7.3 · Published 2026-09-16

ChangeWeDer CRM is an open-source customer relationship management system built with Spring Boot. The application improperly validates user identity when reading session cookies, allowing attackers to forge credentials and impersonate any user, including administrators, without authentication. This could lead to unauthorized access to customer data, configuration changes, or system compromise.

Quick answers

Is CVE-2026-92401 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92401 being exploited in the wild.
How severe is CVE-2026-92401?: High severity, with a CVSS score of 7.3, published 16 September 2026.
Which products and versions are affected?: ChangeWeDer CRM up to c07bd4c97141521af6475034bc58523beed51bbd.
Is there a fix for CVE-2026-92401?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92401 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92401?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the LoginUserUtil.releaseUserIdFromCookie() method, which extracts user ID from cookies without verifying ownership or legitimacy. The user ID is encoded via UserIdBase64, which only performs base64 encoding and simple string transformation (concatenation, reversal, character substitution) without cryptographic protection. An unauthenticated attacker can craft a malicious cookie by encoding an arbitrary user ID (e.g., admin) and send it with requests to the application. The application will accept the forged identity and grant access. No authentication is required; the attack is remotely exploitable. The project uses continuous delivery with rolling releases, so no specific version information is available, and the maintainers have not yet responded to the vulnerability report.

Affected products

ChangeWeDer CRM up to c07bd4c97141521af6475034bc58523beed51bbd

Timeline

2026-08-20: disclosed: Issue reported on GitHub by mjh134
2026-09-16: advisory: CVE-2026-92401 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.