8.7
CVE-2026-85212
- EPSS 0.33%
- Veröffentlicht 03.09.2026 14:12:23
- Zuletzt bearbeitet 10.09.2026 15:53:23
- Erkennungen
CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellercrmeb
≫
Produkt
CRMEB
Default Statusunaffected
Version <=
6.0.0
Version
0
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.33% | 0.252 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| disclosure@vulncheck.com | 8.7 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| disclosure@vulncheck.com | 8.3 | 2.8 | 5.5 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
|
CWE-862 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
https://github.com/crmeb/CRMEB
https://github.com/crmeb/CRMEB/issues/119
https://github.com/crmeb/CRMEB/blob/v6.0.0/crmeb/app/services/system/admin/SystemRoleServices.php
https://www.vulncheck.com/advisories/crmeb-through-6.0.0-missing-authorization-via-inert-verifyauth-role-check