CVE-2026-3265 Details

A critical authorization vulnerability has been identified in Indotalent Free-CRM versions through commit b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. The vulnerability resides in the Security API, specifically within the file '/api/Security/'. It allows low-privileged authenticated users to bypass authorization and access privileged endpoints. This exploitation can be done remotely, leading to unauthorized actions such as enumerating all user accounts, including administrators, accessing sensitive profile information, and modifying or disabling any user account. The issue stems from missing server-side authorization checks on key security APIs, combined with the exposure of these endpoints through an unauthenticated Swagger documentation.

It is recommended to restrict access to the Swagger documentation in production environments, enforce server-side role-based access controls on security APIs, implement object-level authorization to ensure users can only access their own data, and conduct thorough security testing before releasing updates.