CVE-2026-3264

A vulnerability was determined in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. Affected by this issue is some unknown functionality of the component Administrative Interface. Executing a manipulation can lead to execution after redirect. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-698
• CWE-705

• https://github.com/Ghufran2/CVE-Free-CRM-Advisories/blob/main/Free-CRM%20Privilege%20Escalation%20via%20Client-Side%20Redirect%20Authorization%20Bypass.mdExploit, Mitigation, Third Party Advisory
• https://vuldb.com/?ctiid.347987Permissions Required, VDB Entry
• https://vuldb.com/?id.347987Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.758337Third Party Advisory, VDB Entry

Published

Feb 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32632Glances is an open-source system cross-platform monitoring t…5.9
• CVE-2026-32633Glances is an open-source system cross-platform monitoring t…9.1
• CVE-2026-32634Glances is an open-source system cross-platform monitoring t…8.1
• CVE-2026-32635Angular is a development platform for building mobile and de…9
• CVE-2026-32636ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-32638StudioCMS is a server-side-rendered, Astro native, headless …2.7
• CVE-2026-32640SimpleEval is a library for adding evaluatable expressions i…9.8
• CVE-2026-32642Incorrect Authorization (CWE-863) vulnerability in Apache Ar…4.3
• CVE-2026-32643A vulnerability exists in BIG-IP and BIG-IQ systems where a …8.7
• CVE-2026-32644Specific firmware versions of Milesight AIOT cameras use SSL…9.8
• CVE-2026-32646A specific administrative endpoint is accessible without pro…8.7
• CVE-2026-32647NGINX Open Source and NGINX Plus have a vulnerability in the…8.5