CVE-2026-85212

CRMEB, a PHP-based open-source e-commerce/CRM platform, contains a missing-authorization flaw (CWE-862) in the verifyAuth() method of SystemRoleServices.php, where both conditional branches return true so the role-permission check always permits the request. A sub-administrator, or any backend account with no assigned roles, can send requests to restricted admin endpoints and have them processed as fully authorized. Because the check is inert, an attacker who already holds a low-privilege backend login gains access to administrative functionality, with high confidentiality and integrity impact per the CVSS 4.0 vector (network-accessible, low attack complexity, no user interaction). Affected are CRMEB deployments, with version ranges not specified in the available data; anonymous users are not affected, since some valid backend account (PR:L) is required. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; EPSS is 0.3% over 30 days (25th percentile).

What to do: No fixed version is specified in the available data, so monitor the CRMEB vendor's advisories and releases and, when a patch lands, verify that verifyAuth() in SystemRoleServices.php no longer unconditionally returns true. Until then, restrict admin-panel access (IP allowlisting, VPN, or reverse-proxy authentication), audit logs for admin-endpoint access by sub-administrator or role-less accounts, and revoke unnecessary backend logins.