CVE-2025-10390

Name of the Vulnerable Software and Affected Versions: CRMEB versions prior to 5.6.2

Description: A weakness exists in CRMEB due to improper authorization. The issue is located in the editAddress function of the app/services/user/UserAddressServices.php file. Manipulation of the ID argument can lead to exploitation. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations: Update CRMEB to version 5.6.2 or later. As a temporary workaround, restrict access to the editAddress function in app/services/user/UserAddressServices.php until a patch is available. Avoid using the ID parameter in the affected function until the issue is resolved.