| Package | Affected versions | Patched versions |
|---|---|---|
| vtiger crm | ≥ 7.0, < 7.2.0 | 7.2.0 |
In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free