CVE-2026-31845 is a reflected XSS vulnerability in Rukovoditel CRM affecting version 3.6.4 and earlier. The issue arises because the application directly reflects user-supplied input from the 'zd_echo' GET parameter in the /api/tel/zadarma.php endpoint without proper input neutralization, output encoding, or content-type restrictions. This improper handling of input can lead to script injection attacks.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the vulnerable application, potentially leading to session hijacking, defacement, or other malicious actions within the user's browser. The CVSS 4.0 base score is 9.3 (critical), indicating a high impact with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint or applying web application firewall (WAF) rules to detect and block malicious input targeting the 'zd_echo' parameter.