{"answers":{"affected":"2 open source packages ship an affected version, including fat_free_crm.","exploited":"There is no known exploitation of GHSA-9pm8-vwc5-w2hm in the wild and no public exploit code.","fix":"Upgrade fat_free_crm to 0.26.0 or later.","what":"GHSA-9pm8-vwc5-w2hm is a missing authorization vulnerability in fat_free_crm, published on 14 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-9pm8-vwc5-w2hm and fix it if it is affected.\n\nWhat it is: GHSA-9pm8-vwc5-w2hm is a missing authorization vulnerability in fat_free_crm, published on 14 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-9pm8-vwc5-w2hm in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- fat_free_crm (RubyGems): affected all versions; fixed in 0.26.0\n- fat_free_crm (RubyGems): affected all versions; fixed in 0.26.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-9pm8-vwc5-w2hm/ (Markdown: https://insights.sbomify.com/GHSA-9pm8-vwc5-w2hm/index.md)","id":"GHSA-9pm8-vwc5-w2hm","markdown":"https://insights.sbomify.com/GHSA-9pm8-vwc5-w2hm/index.md","name":"GHSA-9pm8-vwc5-w2hm","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_modify"],"network_reachable":"yes","non_default_config":true,"product_category":"CRM web application","requires_auth":"low_privilege","summary":"Authenticated users can delete other users' emails via ID manipulation when the Email Dropbox feature is enabled.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\nAuthenticated users can delete emails imported into the system assigned to another user; where the [Email Dropbox](https://github.com/fatfreecrm/fat_free_crm/wiki/Email-Dropbox) is in use.\n\n### Patches\n\nFixed in v0.26.0\n\n### Workarounds\n\nDisable use of email dropbox.","ecosystems":["RubyGems"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID","id":"GHSA-9pm8-vwc5-w2hm","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"RubyGems","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"RubyGems","fixed":["0.26.0"],"introduced":["0"],"last_affected":[],"package":"fat_free_crm","purl":null,"source":"GHSA-9pm8-vwc5-w2hm"},{"ecosystem":"RubyGems","fixed":["0.26.0"],"introduced":["0"],"last_affected":[],"package":"fat_free_crm","purl":"pkg:gem/fat_free_crm","source":"GHSA-9pm8-vwc5-w2hm"}],"products":null,"published":"2026-04-14","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Authenticated users can delete other users' emails via ID manipulation when the Email Dropbox feature is enabled.","url":"https://insights.sbomify.com/GHSA-9pm8-vwc5-w2hm/"}