CVE-2011-4679: Vtiger CRM

Medium severity, CVSS 4.0. EPSS: 1% chance of exploitation in the next 30 days.

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report.

Affected products

• Vtiger Vtiger CRM: before 5.3.0 (fixed in 5.3.0)

Published 2011-12-07. Last modified 2026-06-16.