Executive brief
ChangeWeDer CRM is an open-source customer relationship management system built with Spring Boot. The application improperly validates user identity when reading session cookies, allowing attackers to forge credentials and impersonate any user, including administrators, without authentication. This could lead to unauthorized access to customer data, configuration changes, or system compromise.
Technical details
The vulnerability exists in the LoginUserUtil.releaseUserIdFromCookie() method, which extracts user ID from cookies without verifying ownership or legitimacy. The user ID is encoded via UserIdBase64, which only performs base64 encoding and simple string transformation (concatenation, reversal, character substitution) without cryptographic protection. An unauthenticated attacker can craft a malicious cookie by encoding an arbitrary user ID (e.g., admin) and send it with requests to the application. The application will accept the forged identity and grant access. No authentication is required; the attack is remotely exploitable. The project uses continuous delivery with rolling releases, so no specific version information is available, and the maintainers have not yet responded to the vulnerability report.
Affected products
- ChangeWeDer CRM up to c07bd4c97141521af6475034bc58523beed51bbd
Timeline
- 2026-08-20: disclosed: Issue reported on GitHub by mjh134
- 2026-09-16: advisory: CVE-2026-92401 published