This vulnerability in ChangeWeDer crm involves improper authentication caused by manipulation of the releaseUserIdFromCookie function in the LoginUserUtil utility. The flaw allows remote attackers to bypass authentication controls, potentially gaining unauthorized access. Because the product employs continuous delivery with rolling releases, no explicit affected or patched versions are identified. The issue was reported early to the project, but no vendor advisory or patch information is currently available.

The vulnerability enables remote attackers to bypass authentication mechanisms, which could lead to unauthorized access to the CRM system. The CVSS 4.0 score of 6.9 (medium severity) reflects the network attack vector with no privileges or user interaction required, but with low to limited confidentiality, integrity, and availability impacts. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, monitor official ChangeWeDer channels for updates. Until a fix is available, consider restricting access to the CRM system to trusted networks or users to reduce exposure.