{"action":"Upgrade fat_free_crm to 0.26.0 or later.","affected":[{"fixed":"0.26.0","introduced":"0"}],"component":"fat_free_crm","cve_ids":[],"ecosystem":"RubyGems","exploited":false,"fixed_versions":["0.26.0"],"ghsa_id":"GHSA-9pm8-vwc5-w2hm","id":"tcs_01M5KEJEXM7JJ4B5HH4YN88F85","modified_at":"2026-04-14T01:25:46.759995Z","published_at":"2026-04-14T01:07:01Z","references":["https://osv.dev/vulnerability/GHSA-9pm8-vwc5-w2hm","https://github.com/fatfreecrm/fat_free_crm/security/advisories/GHSA-9pm8-vwc5-w2hm","https://github.com/fatfreecrm/fat_free_crm"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-9pm8-vwc5-w2hm","url":"https://osv.dev/vulnerability/GHSA-9pm8-vwc5-w2hm"}],"summary":"Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID"}