CVE-2026-96903: Easy Property Listings 0 to before 3.5.27

Affected technology

Easy Property Listings · 0 to before 3.5.27
Vendor not specified by the source

Description’s affected range: before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions

Component: Not specified by the source

What an attacker can do

Any authenticated user with a role as low as subscriber can read other users' CRM contact and lead records, including their private activity notes.