RubyGems/fat_free_crm: low
Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID
Action: Upgrade fat_free_crm to 0.26.0 or later.
bundle update fat_free_crmAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.26.0 | - |
Fixed versions
| 0.26.0 |
Sources
- osv: GHSA-9pm8-vwc5-w2hm
- https://github.com/fatfreecrm/fat_free_crm/security/advisories/GHSA-9pm8-vwc5-w2hm
- https://github.com/fatfreecrm/fat_free_crm
published · modified · JSON