Executive brief
ChangeWeDer CRM is a Spring Boot-based customer relationship management system. A missing authorization flaw in the user management endpoint allows any authenticated user to create new users with arbitrary permissions, effectively bypassing role-based access controls and allowing privilege escalation.
Technical details
The vulnerability is an authorization bypass (missing access control) in the UserController.java component, specifically the `/user/index` and `/user/save` endpoints. The affected endpoints lack authorization annotations and do not perform permission checks on user input. An authenticated attacker with basic user privileges can call these endpoints remotely to create new administrative accounts or modify user roles without proper authorization. No official patch has been released; the project maintainers have not yet responded to the issue report.
Affected products
- ChangeWeDer CRM up to c07bd4c97141521af6475034bc58523beed51bbd
Timeline
- 2026-09-16: disclosed: Public disclosure via NVD
- 2026-08-20: other: Issue reported on GitHub