CVE-2026-113600 Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-113600?
CVE-2026-113600 is a medium-severity vulnerability in fatfreecrm fat_free_crm, published on 20 Oct 2026.
Official description
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE requests to /comments/:id with enumerable sequential IDs to edit or delete comments on contacts, accounts, leads, and opportunities owned by others.
Weakness: CWE-639
Which versions are affected by CVE-2026-113600?
How do I fix CVE-2026-113600?
No fix has been published for CVE-2026-113600 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-113600 being exploited?
There is no known exploitation of CVE-2026-113600 in the wild and no public exploit code.
Sources
Also known as GHSA-gh75-88g6-gr96.