Security Advisory
CVE-2026-85212
8.3
HIGH
Vulnerability Description
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.
Published Date
September 3, 2026
Official Source
NIST NVD Advisory