CVE-2026-113600: Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy

Q: Who can exploit this issue?

Any authenticated Fat Free CRM user can exploit it. The attacker only needs a valid account and does not need interaction from another user.

Q: What access and requests are required to modify or delete another user's comment?

An attacker needs to identify a target comment ID, which may be possible by enumerating sequential IDs, then send a PUT request to /comments/:id to edit it or a DELETE request to /comments/:id to remove it.

Q: Which comments may be affected?

Comments attached to contacts, accounts, leads, and opportunities owned by other users may be modified or deleted.

Q: How can administrators determine whether they are affected?

Deployments running a Fat Free CRM version before 0.26.0 are affected. Review comment update and deletion activity, particularly requests targeting comment IDs associated with records owned by different users, for signs of unauthorized changes or deletions.

Published Oct 20, 2026

Updated

Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE requests to /comments/:id with enumerable sequential IDs to edit or delete comments on contacts, accounts, leads, and opportunities owned by others.

Affected Software

1 affected component

Fat Free CRM Fat Free CRM<0.26.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fat Free CRM to a version that resolves this vulnerability.
Fixed in 0.26.0

Event History

Oct 20, 2026

CVE Published

via MITRE·03:40 PM

Data Sourced

via MITRE·03:40 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated Fat Free CRM user can exploit it. The attacker only needs a valid account and does not need interaction from another user.

What access and requests are required to modify or delete another user's comment?

An attacker needs to identify a target comment ID, which may be possible by enumerating sequential IDs, then send a PUT request to /comments/:id to edit it or a DELETE request to /comments/:id to remove it.

Which comments may be affected?

Comments attached to contacts, accounts, leads, and opportunities owned by other users may be modified or deleted.

How can administrators determine whether they are affected?

Deployments running a Fat Free CRM version before 0.26.0 are affected. Review comment update and deletion activity, particularly requests targeting comment IDs associated with records owned by different users, for signs of unauthorized changes or deletions.

CVE-2026-113600: Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access and requests are required to modify or delete another user's comment?

Which comments may be affected?

How can administrators determine whether they are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access and requests are required to modify or delete another user's comment?

Which comments may be affected?

How can administrators determine whether they are affected?