CVE-2026-85177
Received Received - Intake

CRMEB Message Ownership Validation Bypass

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is_del, look, and uid to delete, mark read, or reassign victim notifications without authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85177
EUVD
EUVD-2026-70481

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CRMEB through version 6.0.0 has a vulnerability in the edit_message handler of MessageSystemController.php where message ownership is not validated. This allows authenticated users to modify any system inbox message. Attackers can change message properties like is_del, look, and uid to delete messages, mark them as read, or reassign notifications to other users without proper authorization.

Impact Analysis

This vulnerability could allow attackers to delete important messages, mark unread messages as read, or redirect notifications meant for you to another user. This could lead to missed critical communications, unauthorized access to sensitive information, or disruption of normal system operations.

Mitigation Strategies

Update CRMEB to the latest version beyond 6.0.0 to ensure proper message ownership validation. Review system inbox messages for unauthorized modifications and restrict authenticated user permissions to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85177. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart