CVE-2023-43317 is a high severity (CVSS 8.8) privilege escalation flaw in Coign CRM Portal version 06.06. A logged in user can change the userPermissionsList value held in the browser's session storage to reach administrative features. No vendor fix is confirmed in the sources, so contact the vendor and review server side checks.
What's affected
The record lists one product and version, Coign CRM Portal 06.06. It says a remote attacker can escalate privileges through the userPermissionsList parameter in the Session Storage component.
The only reference is a public write-up on GitHub by the researcher. It says a normal user can raise their privileges by changing the userPermissionsList data kept in session storage, gaining access to administrative level resources and features, which could lead to unauthorized data access and changes. It names 06.06 as the vulnerable version.
I found no vendor advisory, no fixed version and no statement from the vendor about other releases. Do not assume that versions other than 06.06 are safe or unsafe. Ask the vendor.
The weakness is CWE-269, improper privilege management. The vector needs a low privilege account, so the person must already be signed in.
How to check if you're exposed
If you run Coign CRM Portal, confirm the version in the product's about or admin page. Then ask a more important question: does the server check the user's role on every request, or does it trust permission data sent by the browser? Your developers or the vendor can answer that. You can also review the server's request logs for administrative endpoints that were called by accounts that should not hold that role.
A web application scanner can help find places where the server trusts values the client controls, though this finding is a design problem that a scanner may not name directly.
What to do now
- Confirm whether you run Coign CRM Portal 06.06 and which other versions are deployed.
- Contact the vendor for a fixed release or a configuration change, and ask for its status in writing.
- Review server logs for administrative actions performed by accounts that should not have them.
- Reduce who has a login, and remove unused accounts.
- Put the portal behind your single sign on or a VPN if the vendor allows it.
- Reset administrator sessions and credentials if you find evidence of misuse.
Why it matters
The core mistake is trusting the client. Session storage lives in the user's browser, so the user controls it. If the application uses a permission list from there to decide what a person may see or do, any signed in user can edit the list. Authorization has to be enforced on the server for each request, using data the server holds.
The weakness class is CWE-269. The record's vector is network based, needs a low privilege account and no user interaction, and the impact is high on all three measures. This is why an ordinary CRM login can turn into access to customer data and settings. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed version?
None is confirmed. The record and its one reference name only 06.06 as vulnerable. Ask the vendor for a status.
Sources
Last reviewed: 19 October 2026.
