CVE-2026-85212: CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CRMEBto a version that resolves this vulnerability.Fixed in 6.0.0 - Configuration
Fix the authentication/authorization bypass in SystemRoleServices.php by correcting verifyAuth() so restricted admin endpoints are not accessible via an always-permit (inert) role check.
CRMEB SystemRoleServices.php (verifyAuth method) verifyAuth return value logic (role check) = Ensure verifyAuth does NOT return true in both conditional branches
Event History
Frequently Asked Questions
Which accounts can exploit this authorization bypass?
Sub-administrator accounts and accounts with no roles can access restricted administrative endpoints because the affected role check always permits requests.
Does exploitation require an existing authenticated account?
Yes. The listed attack vector requires low privileges, and the affected users are sub-administrators or accounts with no assigned roles; no user interaction is required.
Which CRMEB versions are identified as affected?
The issue is reported in CRMEB through version 6.0.0.