CVE-2026-113600

Name of the Vulnerable Software and Affected Versions Fat Free CRM versions prior to 0.26.0

Description An insecure direct object reference allows authenticated users to modify or delete comments belonging to other users. This occurs because the update() and destroy() functions within the CommentsController utilize an unscoped Comment.find method that lacks proper authorization checks. An attacker can exploit this by sending PUT or DELETE requests to the '/comments/:id' endpoint using sequential IDs to manipulate comments associated with contacts, accounts, leads, and opportunities owned by other users.

Recommendations Update Fat Free CRM to version 0.26.0 or later.