Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-113600Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in fat_free_crm from fatfreecrm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 72.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE requests to /comments/:id with enumerable sequential IDs to edit or delete comments on contacts, accounts, leads, and opportunities owned by others.

Affected products (as reported)

Vendor	Product	Versions
fatfreecrm	fat_free_crm	0 – before 0.26.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

https://github.com/fatfreecrm/fat_free_crm/issues/1650 issue-tracking
https://github.com/fatfreecrm/fat_free_crm/commit/3c3199328dd10414b1f039ab8e4a82fe0f3baf87 patch
fat_free_crm v0.26.0 Release Notes release-notes
https://github.com/fatfreecrm/fat_free_crm/blob/v0.25.0/app/controllers/comments_controller.rb technical-description
VulnCheck Advisory: Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy third-party-advisory