fat_free_crm vulnerabilities

CVEs whose affected-version data names the fat_free_crm package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-113600Medium· 5.4

today

Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy

Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find w…

▾ Sunlitfatfreecrm · fat_free_crmvia CVEORG