HIGH 8.7 NVD
CVE-2026-85212
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.
References
- https://github.com/crmeb/CRMEB
- https://github.com/crmeb/CRMEB/blob/v6.0.0/crmeb/app/services/system/admin/SystemRoleServi
- https://github.com/crmeb/CRMEB/issues/119
- https://www.vulncheck.com/advisories/crmeb-through-6.0.0-missing-authorization-via-inert-v
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-09-03 via NVD.
vulnfeed aggregates 7805 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.