CVE-2026-19433

CVE-2026-19433 is a tenant isolation failure in the contact module that compounds a blind write primitive with vCard export to create risks that a standard IDOR severity model underestimates. The vulnerability allows an attacker to overwrite contact records belonging to other companies by iterating numeric IDs—no reconnaissance needed, no feedback about whose data is being touched. The same flawed retrieval pattern also enables exporting those contacts as vCards, exfiltrating names, emails, phone numbers, and job titles with no traceability. The attack path most defenders miss: an attacker who overwrites a contact's email address with their own doesn't just steal one vCard export. They insert themselves into every automated email, sequence, notification, and CRM-sync that touches that record going forward. The victim corrects the record? The attacker overwrites it again. This isn't a snapshot data breach—it's a persistent relay channel into the victim's communication infrastructure that survives patch deployment. A patched system still contains corrupted contacts if exploitation occurred pre-5.4.8. The CVSS 8.6 rating reflects the auditable harm from vCard exfiltration (PII leakage), but the write primitive is the more dangerous component—it creates standing access rather than a one-time leak. Check whether your instance has any audit logging on contact overwrite operations to detect pre-patch exploitation. The patch likely adds tenant_id filtering to the query layer, but verify this isn't client-side validation that could be bypassed. More importantly, treat this as a symptom: audit every data retrieval operation in the codebase that accepts an object ID parameter, because if the same retrieval pattern exists in invoice handling or document storage, you've got a larger problem. The contact module's retrieval logic likely predates multi-tenancy and has survived multiple architectural evolutions without being re-examined—that's why this pattern recurs across CRM variants roughly every 18 months.

Reviewed through automated stages and approved by a human before publication.