CVE-2026-85177
Received Received - Intake

CRMEB Message Ownership Validation Bypass

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is_del, look, and uid to delete, mark read, or reassign victim notifications without authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-05
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85177
EUVD
EUVD-2026-70481

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
crmeb crmeb to 6.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CRMEB through version 6.0.0 has a vulnerability in the edit_message handler of MessageSystemController.php where message ownership is not validated. This allows authenticated users to modify any system inbox message. Attackers can change message properties like is_del, look, and uid to delete messages, mark them as read, or reassign notifications to other users without proper authorization.

Detection Guidance

To detect this vulnerability, monitor API requests to the edit_message endpoint in CRMEB's MessageSystemController.php. Look for requests where the uid parameter does not match the authenticated user's ID. Check for unusual modifications to message properties like is_del, look, or uid. Review logs for unauthorized access attempts to message data.

Impact Analysis

This vulnerability could allow attackers to delete important messages, mark unread messages as read, or redirect notifications meant for you to another user. This could lead to missed critical communications, unauthorized access to sensitive information, or disruption of normal system operations.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized users to access, modify, or delete sensitive messages without proper authorization. GDPR requires strict access controls for personal data, while HIPAA mandates protection of health-related communications. Unauthorized message modification may lead to unauthorized disclosure or alteration of protected information.

Mitigation Strategies

Update CRMEB to the latest version beyond 6.0.0 to ensure proper message ownership validation. Review system inbox messages for unauthorized modifications and restrict authenticated user permissions to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85177. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart