F-RevoCRM CVE-2026-71368: Cross-Site Scripting Targeting Logged-in Users

A Cross-Site Scripting (XSS) vulnerability has been discovered in F-RevoCRM versions 7.3.0 to 8.0.3. This flaw allows an attacker to send a specially crafted URL or web page to a logged-in user, which, when opened, enables arbitrary scripts to run in the CRM's origin. This can potentially lead to the theft of session information or unauthorized CRM operations using the victim's privileges.

The vulnerability arises when the user opens the crafted URL, triggering the execution of malicious JavaScript within their browser, which runs with F-RevoCRM origin privileges. This allows the attacker to carry out various malicious operations, such as stealing session information or executing unintended CRM actions.

Detecting this attack can be challenging, as the CRM's interface may appear normal, and there may be no clear warning signs of session theft. Administrators, however, may observe unusual activity such as sudden changes to the CRM interface or unexpected communications with external domains.

To mitigate the risk, users are advised to update to version 8.0.4, avoid logging in to F-RevoCRM from untrusted sites, and utilize separate browsers or isolated environments when accessing both the CRM and external sites. Additionally, protecting session cookies and implementing re-authentication for critical operations can further enhance security.