CVE-2026-85177
MediumCVSS 5.4Summary
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is_del, look, and uid to delete, mark read, or reassign victim notifications without authorization.
Risk Assessment
The risk includes compromise of integrity and confidentiality of system messages, which could lead to manipulation of notifications and potentially to fraud or misinformation.
Recommendation
It is recommended to implement resource ownership checks in the edit_message handler so that users can only modify their own messages, and to upgrade CRMEB to the latest version.
Other vulnerabilities in CRMEB
See all- CVE-2026-85212High
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.
- CVE-2023-30185Critical
CRMEB versions 4.4 to 4.6 were found to have an arbitrary file upload vulnerability. The flaw resides in the \attachment\SystemAttachmentServices.php component.
- CVE-2020-25466Critical
An SSRF vulnerability in the downloadimage interface of CRMEB 3.0 allows remote attackers to download arbitrary files from the server and execute arbitrary code remotely.
Original NVD description (English source)
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is_del, look, and uid to delete, mark read, or reassign victim notifications without authorization.