CVE-2026-85177 Details
Description
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is_del, look, and uid to delete, mark read, or reassign victim notifications without authorization.
A vulnerability exists in CRMEB versions through 6.0.0, specifically in the edit_message function of MessageSystemController.php. This vulnerability allows authenticated users to modify any system inbox message without proper authorization. The issue arises because the application fails to validate message ownership before allowing edits. As a result, attackers can alter various message attributes, such as deletion status, read status, and message ownership, thereby manipulating notification visibility for other users.
The vulnerability can be addressed by implementing a check to ensure that the message being edited belongs to the user making the request. This can be done by verifying the message ownership before allowing any modifications.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/crmeb/CRMEB/issues/120 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/crmeb/CRMEB | [email protected] | Vendor |
| https://github.com/crmeb/CRMEB/blob/v6.0.0/crmeb/app/api/controller/v1/user/MessageSystemController.php | [email protected] | Source CodeVendor |
| https://github.com/crmeb/CRMEB/issues/120 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/crmeb-through-6.0.0-unauthorized-message-modification-via-edit-message | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CRMEB | <= 6.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | New CVE Received | [email protected] |
| Sep 3, 2026 | CVE Modified | CISA-ADP |