fatfreecrm CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM fatfreecrm CVE published 2026-10-20

CVE-2026-113600

CVE-2026-113600 is a medium-severity insecure direct object reference vulnerability in Fat Free CRM before 0.26.0. This vulnerability allows authenticated users to modify or delete comments belonging to other users due to an unscoped Comment.find method without proper authorization checks in the CommentsController. The likely operational impact includes unauthorized modification or deletion of comments on [truncated]