CRMEB CVE-2026-85212

Exploitation requires a valid authenticated CRMEB session - any account is sufficient, including sub-administrator accounts or accounts with zero assigned roles. No elevated privileges, non-default configuration, or specific deployment mode is required beyond holding a working login session. The CVSS PR:L vector confirms that fully unauthenticated exploitation (without any session) is not possible; a valid account credential is the minimum prerequisite. The admin panel API surface must also be network-reachable from the attacker's position. No user interaction from a victim is required once the session is established.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) reflects a straightforward, network-accessible, low-complexity exploit that demands only a valid authenticated session - even a mid-sized municipal IT team in sanok operating a CRMEB-powered storefront should treat this as urgent if any sub-administrator or role-less accounts exist in the system. The high confidentiality and integrity impact ratings are credible: unrestricted access to admin endpoints typically exposes customer records, order data, and configuration controls. No EPSS score is provided in the available data, and no CISA KEV listing exists; however, the public GitHub issue (#119) and VulnCheck advisory lower the bar for independent exploitation by documenting the precise vulnerable method and file. The PR:L requirement - an authenticated low-privilege user - is the primary realistic mitigating factor, as fully unauthenticated exploitation is not supported by the CVSS vector or the description.

An attacker who possesses any valid CRMEB login - such as a former employee's sub-admin account or an account provisioned with no roles - authenticates to obtain a session token and then directly calls role-restricted admin API endpoints. Because verifyAuth() returns true unconditionally, all authorization checks pass without inspecting the caller's role set. The attacker can enumerate customer records, modify orders, extract stored credentials, or alter platform configuration without possessing any legitimately elevated privilege.