Products
One platform for sales, frontline, operations and AI agents, built on XOS.
Software
Free, self-hosted and open source. Run erxes on your own servers.
Solutions
By industry
Community
Install erxes, build plugins and contribute.
Company
Our mission, our team and the values behind erxes.
Staff actions now check the request’s origin before accepting cookie-based authentication.
Requests that change data using a staff sign-in cookie now require an allowed origin. Requests from the same site, configured allowed origins, or the tenant’s active custom domain can pass the check.
This closes a gap where an unrelated website could submit a request using the browser’s existing staff cookie. Self-hosted installations with a frontend on a separate domain must include it in their allowed-domain configuration.
Available in erxes v3.4.7, released October 29, 2026.
Talk to our team about consolidating your stack onto erxes. 30-minute walkthrough, custom to your org.