# Fat Free CRM BOLA in Email Dropbox

Source: https://junglewise.ai/threats/fat-free-crm-bola-in-email-dropbox-06483599  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

Severity: low · CVSS 2.1 · Published 2026-04-14

Fat Free CRM is an open-source customer relationship management platform. A security flaw in the Email Dropbox feature allows any logged-in user to delete emails belonging to other users by guessing or knowing the email's ID. This could lead to the loss of important customer communication records and disrupt business operations.

Technologies: [fat_free_crm (RubyGems)](https://junglewise.ai/threats/technologies/fat-free-crm). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 2.1, published 14 April 2026.

**Which products and versions are affected?** fat_free_crm (RubyGems) < 0.26.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-04-14: Fix released in version 0.26.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a network appliance.

**Am I affected?** Check whether you run fat_free_crm (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Broken Object Level Authorization (BOLA) vulnerability exists in Fat Free CRM's 'Email Dropbox' component. The 'DELETE /emails/:id' endpoint fails to properly validate that the authenticated user has the authority to delete the specific email record identified by the ':id' parameter. An attacker with a low-privileged account can exploit this by sending unauthorized DELETE requests to remove emails assigned to other users. This issue is addressed in version 0.26.0; users unable to upgrade can mitigate the risk by disabling the Email Dropbox feature.

## Affected products

- Fat Free CRM Fat Free CRM < 0.26.0

## Timeline

- 2026-04-12: disclosed: Initial disclosure by reporter
- 2026-04-14: advisory: GitHub Advisory published
- 2026-04-14: patched: Fix released in version 0.26.0

## References

- [https://api.github.com/users/bgeesaman](https://api.github.com/users/bgeesaman)
- [https://github.com/bgeesaman](https://github.com/bgeesaman)
- [https://api.github.com/users/bgeesaman/gists%7B/gist_id%7D](https://api.github.com/users/bgeesaman/gists%7B/gist_id%7D)
- [https://api.github.com/users/bgeesaman/repos](https://api.github.com/users/bgeesaman/repos)
- [https://avatars.githubusercontent.com/u/3769609?v=4](https://avatars.githubusercontent.com/u/3769609?v=4)
- [https://api.github.com/users/bgeesaman/events%7B/privacy%7D](https://api.github.com/users/bgeesaman/events%7B/privacy%7D)

## Related threats

- [Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint](https://junglewise.ai/threats/cve-2022-39281-fat-free-crm-vulnerable-to-remote-denial-of-service-via-tasks)
- [Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability](https://junglewise.ai/threats/cve-2019-10226-withdrawn-advisory-fat-free-crm-cross-site-scripting)
- [Fat Free CRM allows remote attackers to obtain sensitive information via a direct request](https://junglewise.ai/threats/cve-2013-7224-fat-free-crm-allows-remote-attackers-to-obtain-sensitive)
- [Fat Free CRM contains Cross-site Request Forgery vulnerablilities](https://junglewise.ai/threats/cve-2013-7223-fat-free-crm-contains-cross-site-request-forgery-vulnerablilities)
- [Fat Free CRM vulnerable to SQL Injection](https://junglewise.ai/threats/cve-2013-7225-fat-free-crm-vulnerable-to-sql-injection)