CVE-2009-3257: Vtiger CRM

Low severity, CVSS 3.6. EPSS: 0.9% chance of exploitation in the next 30 days.

vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the (1) Account Billing Address and (2) Shipping Address fields in a profile by creating a Sales Order (SO) associated with that profile.

Affected products

• Vtiger Vtiger CRM: before 5.1.0 (fixed in 5.1.0)

Published 2009-09-18. Last modified 2026-06-16.