CVE-2026-85212

Name of the Vulnerable Software and Affected Versions CRMEB versions prior to 6.0.0

Description An authentication bypass exists in the verifyAuth() function within SystemRoleServices.php. The issue stems from an inert role check that returns true regardless of the conditional branch taken. This allows sub-administrators and accounts without assigned roles to gain unauthorized access to restricted admin endpoints.

Recommendations Update to a version newer than 6.0.0. As a temporary mitigation, restrict access to the verifyAuth() function in SystemRoleServices.php.