CVE-2026-85212
Received Received - Intake

Authentication Bypass in CRMEB via SystemRoleServices

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85212
EUVD
EUVD-2026-70490

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
crmeb crmeb to 6.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CRMEB has an authentication bypass flaw in the verifyAuth() method of SystemRoleServices.php. The method always returns true from both conditional branches, allowing sub-administrators and accounts with no roles to access restricted admin endpoints by exploiting the inert role check.

Impact Analysis

Attackers with minimal privileges could gain unauthorized access to sensitive admin functions, potentially leading to data theft, system manipulation, or further network compromise. The high impact on confidentiality and integrity (CVSS 8.3-8.7) indicates significant risk.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance risks legal penalties and reputational damage.

Mitigation Strategies

Update CRMEB to the latest patched version immediately to fix the authentication bypass in SystemRoleServices.php. Review and restrict access to admin endpoints for sub-administrators and accounts without roles. Monitor logs for unauthorized access attempts to restricted endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85212. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart