Fat Free CRM BOLA in Email Dropbox

Executive brief

Fat Free CRM is an open-source customer relationship management platform. A security flaw in the Email Dropbox feature allows any logged-in user to delete emails belonging to other users by guessing or knowing the email's ID. This could lead to the loss of important customer communication records and disrupt business operations.

Technical details

A Broken Object Level Authorization (BOLA) vulnerability exists in Fat Free CRM's 'Email Dropbox' component. The 'DELETE /emails/:id' endpoint fails to properly validate that the authenticated user has the authority to delete the specific email record identified by the ':id' parameter. An attacker with a low-privileged account can exploit this by sending unauthorized DELETE requests to remove emails assigned to other users. This issue is addressed in version 0.26.0; users unable to upgrade can mitigate the risk by disabling the Email Dropbox feature.

Affected products

• Fat Free CRM Fat Free CRM < 0.26.0

Timeline

• 2026-04-12: disclosed: Initial disclosure by reporter
• 2026-04-14: advisory: GitHub Advisory published
• 2026-04-14: patched: Fix released in version 0.26.0

References

• https://api.github.com/users/bgeesaman
• https://github.com/bgeesaman
• https://api.github.com/users/bgeesaman/gists%7B/gist_id%7D
• https://api.github.com/users/bgeesaman/repos
• https://avatars.githubusercontent.com/u/3769609?v=4
• https://api.github.com/users/bgeesaman/events%7B/privacy%7D