Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 2.1, published 14 April 2026.

Which products and versions are affected?

fat_free_crm (RubyGems) < 0.26.0.

Is there a fix for This vulnerability?

A patch was published on 2026-04-14: Fix released in version 0.26.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a network appliance.

Check whether you run fat_free_crm (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Fat Free CRM BOLA in Email Dropbox

Q: Is there a fix for This vulnerability?

A patch was published on 2026-04-14: Fix released in version 0.26.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected?

Check whether you run fat_free_crm (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: low · CVSS 2.1 · Published 2026-04-14

Fat Free CRM is an open-source customer relationship management platform. A security flaw in the Email Dropbox feature allows any logged-in user to delete emails belonging to other users by guessing or knowing the email's ID. This could lead to the loss of important customer communication records and disrupt business operations.

Technologies: fat_free_crm (RubyGems). Vendors: RubyGems.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 2.1, published 14 April 2026.
Which products and versions are affected?: fat_free_crm (RubyGems) < 0.26.0.
Is there a fix for This vulnerability?: A patch was published on 2026-04-14: Fix released in version 0.26.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a network appliance.
Am I affected?: Check whether you run fat_free_crm (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Broken Object Level Authorization (BOLA) vulnerability exists in Fat Free CRM's 'Email Dropbox' component. The 'DELETE /emails/:id' endpoint fails to properly validate that the authenticated user has the authority to delete the specific email record identified by the ':id' parameter. An attacker with a low-privileged account can exploit this by sending unauthorized DELETE requests to remove emails assigned to other users. This issue is addressed in version 0.26.0; users unable to upgrade can mitigate the risk by disabling the Email Dropbox feature.

Affected products

Fat Free CRM Fat Free CRM < 0.26.0

Timeline

2026-04-12: disclosed: Initial disclosure by reporter
2026-04-14: advisory: GitHub Advisory published
2026-04-14: patched: Fix released in version 0.26.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.