CVE-2026-85177 CRMEB through 6.0.0 Unauthorized Message Modification via edit_message
Authenticated users can modify arbitrary system inbox messages due to missing ownership validation, allowing unauthorized deletion or reassignment of notifications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85177?
CVE-2026-85177 is a medium-severity missing authorization vulnerability in CRMEB, published on 3 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is_del, look, and uid to delete, mark read, or reassign victim notifications without authorization.
Weakness: CWE-639
Which versions are affected by CVE-2026-85177?
How do I fix CVE-2026-85177?
No fix has been published for CVE-2026-85177 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-85177 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85177 exists.
Sources
Also known as GHSA-c94f-pm78-6rh7.