F-RevoCRM CVE-2026-71368: Cross-Site Scripting Targeting Logged-in Users

F-RevoCRM CVE-2026-71368: Cross-Site Scripting Targeting Logged-in Users 1. Basic Information Article Title : Cross-Site Scripting Vulnerability in F-RevoCRM Publisher : JVN Published / Updated Date : 2026-08-17 Severity : Medium Original Source : JVN#58692577 Related Information : F-RevoCRM Developer Advisory Related Malware / Threat Groups : None / Unidentified CVE & Products : CVE-2026-71368, F-RevoCRM 7.3.0 to 8.0.3, Fixed version 8.0.4 2. Summary This is a Cross-Site Scripting (XSS) vulnerability. If an attacker lures a logged-in F-RevoCRM user to a crafted URL, arbitrary scripts can run in the CRM's origin. This can lead to the theft of session information or unintended CRM operations using the user's privileges. 3. Attack Flow Chain Using a Crafted URL An attacker prepares a crafted URL or web page targeting vulnerable F-RevoCRM. The attacker lures a logged-in user to the URL via email, chat, or a website. The user's browser sends a request to the affected version of F-RevoCRM. The attacker's arbitrary script runs in the F-RevoCRM origin. The script tries to perform CRM operations, read screen data, or steal session information in the user's session. The attacker may use the stolen information or the existing session to abuse the account. Public documents do not confirm the exact type of XSS, the vulnerable parameters/endpoints, or whether cookies can be retrieved. Therefore, we do not conclude this is "Reflected XSS" or a "successful cookie theft." 4. Attacker Position and Execution Location The attacker can prepare the crafted URL or page without authentication. User interaction and a valid F-RevoCRM login session are required. Malicious JavaScript runs inside the user's browser with F-RevoCRM origin privileges. Subsequent malicious operations may reach the F-RevoCRM server as legitimate sessions. 5. Visibility for Victims and Administrators Victims / Users The CRM screen may still look normal after opening the URL. Screen transitions, unintended updates, r