F-RevoCRM CVE-2026-71368: Cross-Site Scripting Targeting Logged-in Users
1.
Basic Information Article Title: Cross-Site Scripting Vulnerability in F-RevoCRM Publisher: JVN Published / Updated Date: 2026-08-17 Severity: Medium Original Source: JVN#58692577 Related Information: F-RevoCRM Developer Advisory Related Malware / Threat Groups: None / Unidentified CVE & Products: CVE-2026-71368, F-RevoCRM 7.3.0 to 8.0.3, Fixed version 8.0.4
2.
Summary This is a Cross-Site Scripting (XSS) vulnerability.
If an attacker lures a logged-in F-RevoCRM user to a crafted URL, arbitrary scripts can run in the CRM's origin.
This can lead to the theft of session information or unintended CRM operations using the user's privileges.
3.
Attack Flow Chain Using a Crafted URL An attacker prepares a crafted URL or web page targeting vulnerable F-RevoCRM.
The attacker lures a logged-in user to the URL via email, chat, or a website.
The user's browser sends a request to the affected version of F-RevoCRM.
The attacker's arbitrary script runs in the F-RevoCRM origin.
The script tries to perform CRM operations, read screen data, or steal session information in the user's session.
The attacker may use the stolen information or the existing session to abuse the account.
Public documents do not confirm the exact type of XSS, the vulnerable parameters/endpoints, or whether cookies can be retrieved.
Therefore, we do not conclude this is "Reflected XSS" or a "successful cookie theft."
4.
Attacker Position and Execution Location The attacker can prepare the crafted URL or page without authentication.
User interaction and a valid F-RevoCRM login session are required.
Malicious JavaScript runs inside the user's browser with F-RevoCRM origin privileges.
Subsequent malicious operations may reach the F-RevoCRM server as legitimate sessions.
5.
Visibility for Victims and Administrators Victims / Users The CRM screen may still look normal after opening the URL.
Screen transitions, unintended updates, re-authentication, or external communications may occur.
There may be no clear warning even if session information is stolen.
Administrators / SOC Transitions from external pages or emails to an F-RevoCRM URL with crafted parameters.
Unnatural read, update, export, or setting change operations in a short time within the same session.
Transmission from the browser to an unknown domain.
Because it uses normal devices, IP addresses, and MFA-authenticated sessions, it is hard to detect by successful authentication alone.
6.
Success and Failure Conditions Success Conditions Using F-RevoCRM 7.3.0 to 8.0.3.
The victim is logged in to F-RevoCRM.
The victim opens the crafted URL or page.
The payload reaches vulnerable processing, and the script runs in the browser.
The target operation does not require additional authentication, or usable session information is obtained.
Failure Conditions Updating to version 8.0.4.
Logging out from F-RevoCRM before viewing untrusted sites.
Using the CRM and external sites in separate browsers or isolated environments.
Preventing payload execution via output encoding, CSP, or WAF/Proxy controls.
Preventing subsequent abuse through session cookie protection or re-authentication for critical operations.
7.
What Happens on Success Arbitrary scripts run in the F-RevoCRM origin.
Unintended CRM operations by the user.
Potential theft of session information and account abuse.
Viewing, changing, or exporting customer, deal, and contact information within the CRM is an inference; actual damage has not been confirmed in public documents.
8.
Observable Logs Email Emails containing crafted URLs, sender, Message-ID, and click time.
Email is a possible distribution vector, but not a confirmed fact in this case.
Proxy / SWG / DNS Transitions from external referrers to F-RevoCRM crafted URLs.
Long or encoded parameters, abnormal referrers, communications from the CRM screen to unknown domains.
Endpoint / EDR Browser history, cache, downloads, extensions, and URLs.