CVE-2026-3050
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in Horilla CRM's Leads Module. Attackers can inject malicious scripts via the Notes argument in the global.js file, potentially compromising user sessions. Organizations using Horilla CRM versions up to 1.0.2 are affected.
💻 Affected Systems
- Horilla CRM
📦 What is this software?
Horilla by Horilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal session cookies, hijack user accounts, perform actions as authenticated users, and potentially pivot to internal systems.
Likely Case
Session hijacking, credential theft, defacement of CRM interface, and data exfiltration from the CRM system.
If Mitigated
Limited to UI manipulation within the CRM interface if proper input validation and output encoding are implemented.
🎯 Exploit Status
Exploit requires user interaction (e.g., viewing malicious notes) but is straightforward to execute once injected.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.3
Vendor Advisory: https://github.com/horilla-opensource/horilla-crm/releases/tag/1.0.3
Restart Required: Yes
Instructions:
1. Backup your Horilla CRM instance. 2. Download version 1.0.3 from the official GitHub releases. 3. Replace the affected files, particularly static/assets/js/global.js. 4. Restart the Horilla CRM service. 5. Verify the patch by checking the commit hash fc5c8e55988e89273012491b5f097b762b474546 is applied.
🔧 Temporary Workarounds
Disable Leads Module
allTemporarily disable the affected Leads Module to prevent exploitation.
Modify Horilla CRM configuration to disable the Leads Module (specific commands depend on deployment).
Implement WAF Rules
allConfigure web application firewall to block XSS payloads in the Notes parameter.
Add WAF rule to filter malicious scripts in POST/GET requests to Leads endpoints.
🧯 If You Can't Patch
- Implement strict input validation and output encoding for the Notes field in the Leads Module.
- Restrict access to the Horilla CRM instance using network segmentation and strong authentication.
🔍 How to Verify
Check if Vulnerable:
Check if your Horilla CRM version is 1.0.2 or earlier and if the Leads Module is enabled.Check Version:
Check the version in Horilla CRM's admin interface or configuration files.Verify Fix Applied:
Verify that the commit fc5c8e55988e89273012491b5f097b762b474546 is present in your installation and test XSS payloads in the Notes field.📡 Detection & Monitoring
Log Indicators:
- Unusual script tags or JavaScript in Notes field logs
- Multiple failed XSS attempts in web server logs
Network Indicators:
- HTTP requests containing script tags or encoded payloads to Leads endpoints
SIEM Query:
Search for patterns like '<script>' or 'javascript:' in URI or POST data to /leads/* endpoints.🔗 References
- https://github.com/Horilla-opensource/Horilla-crm/commit/fc5c8e55988e89273012491b5f097b762b474546
- https://github.com/Stolichnayer/Horilla-CRM-Stored-XSS
- https://github.com/horilla-opensource/horilla-crm/releases/tag/1.0.3
- https://vuldb.com/?ctiid.347408
- https://vuldb.com/?id.347408
- https://vuldb.com/?submit.757314
