Skip to content
OpenAdvisories

Vendor

fatfreecrm

2 known vulnerabilities.

Products

fat_free_crm 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-113600

    Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy

    Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find without authorization c…

    fatfreecrm fat_free_crm
  • Medium 6.5
    CVE-2022-39281

    Remote Denial of Service via Tasks endpoint in fat_free_crm

    fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been…

    fatfreecrm fat_free_crm fat_free_crm RubyGems