Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck
CVE-2026-85177CRMEB through 6.0.0 Unauthorized Message Modification via edit_message
Medium 5.4
In plain English
A medium-severity authorization bypass via user-controlled key in CRMEB from crmeb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.4%top 67.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is_del, look, and uid to delete, mark read, or reassign victim notifications without authorization.
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References
- GitHub Issue #120 issue-tracking
- https://github.com/crmeb/CRMEB product
- MessageSystemController.php at v6.0.0 technical-description
- VulnCheck Advisory: CRMEB through 6.0.0 Unauthorized Message Modification via edit_message third-party-advisory