CVE-2026-71368 is a cross-site scripting vulnerability in F-RevoCRM by Thinkingreed Inc. It allows an attacker to execute scripts in the context of a logged-in user by tricking them into viewing a crafted page. This can lead to unintended actions being performed within the application. The vulnerability has a CVSS 3.0 base score of 6.1 with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity. No official remediation or patch information is currently available.

Successful exploitation could allow an attacker to perform unintended operations in the context of the affected user session, potentially leading to limited confidentiality and integrity impacts. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted content while logged into F-RevoCRM.