CVE-2021-39198: Oroinc Client Relationship Management

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.

Affected products

• Oroinc Client Relationship Management: from 3.1.0, up to and including 3.1.24; from 4.1.0, up to and including 4.1.15; from 4.2.0, up to and including 4.2.5

Published 2021-11-19. Last modified 2026-06-17.