CVE-2026-113600 Details
Description
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE requests to /comments/:id with enumerable sequential IDs to edit or delete comments on contacts, accounts, leads, and opportunities owned by others.
A vulnerability allowing insecure direct object reference (IDOR) has been identified in Fat Free CRM versions prior to 0.26.0. This vulnerability allows authenticated users to modify or delete comments belonging to other users. The issue arises because the CommentsController's update and destroy actions use an unscoped Comment.find method without proper authorization checks. As a result, attackers can send PUT or DELETE requests to the /comments/:id endpoint with sequentially enumerable IDs to manipulate comments on various assets, including contacts, accounts, leads, and opportunities owned by others.
Users can upgrade to Fat Free CRM version 0.26.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/fatfreecrm/fat_free_crm/blob/v0.25.0/app/controllers/comments_controller.rb | [email protected] | Source CodeVendor |
| https://github.com/fatfreecrm/fat_free_crm/commit/3c3199328dd10414b1f039ab8e4a82fe0f3baf87 | [email protected] | Source CodeVendor |
| https://github.com/fatfreecrm/fat_free_crm/issues/1650 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/fatfreecrm/fat_free_crm/releases/tag/v0.26.0 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/fat-free-crm-before-0.26.0-idor-via-commentscontroller-update-and-destroy | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Fat Free CRM | >= 0, < 0.26.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |