[CVE-2026-85212] CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServic…

Descripción técnica

CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.

Puntuación CVSS

Score: 8.3/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Debilidades (CWE)

CWE-862

Fuente oficial

Publicado en NIST NVD.