CVE-2026-113600
mediumFat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments…
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE requests to /comments/:id with enumerable sequential IDs to edit or delete comments on contacts, accounts, leads, and opportunities owned by others.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/fatfreecrm/fat_free_crm/blob/v0.25.0/app/controllers/comments_controlle... disclosure@vulncheck.com
- https://github.com/fatfreecrm/fat_free_crm/commit/3c3199328dd10414b1f039ab8e4a82fe0f3baf87 disclosure@vulncheck.com
- https://github.com/fatfreecrm/fat_free_crm/issues/1650 disclosure@vulncheck.com
- https://github.com/fatfreecrm/fat_free_crm/releases/tag/v0.26.0 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/fat-free-crm-before-0.26.0-idor-via-commentscontrolle... disclosure@vulncheck.com