Go2iMails Free-CRM Allows Malicious Users to Access Unauthorized Data

Summary

A security flaw in Go2iMails Free-CRM allows hackers to bypass authorization checks and access sensitive data without permission. This means that malicious users can potentially access confidential information. The vendor has not yet released a fix, but users should consider taking precautions to protect their data.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
go2ismail	free-crm	<= 2025-09-21	–

Original title

A vulnerability was identified in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. This affects an unknown part of the file /api/Security/ of the component Security API. The manip...

Original description

A vulnerability was identified in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. This affects an unknown part of the file /api/Security/ of the component Security API. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

nvd CVSS2.0 6.5

nvd CVSS3.1 8.8

nvd CVSS4.0 5.3

Vulnerability type

CWE-266 Incorrect Privilege Assignment

CWE-285 Improper Authorization

https://github.com/Ghufran2/CVE-Free-CRM-Advisories/blob/main/Free-CRM%20IDOR.md Exploit Mitigation Third Party Advisory
https://vuldb.com/?ctiid.347988 Permissions Required VDB Entry
https://vuldb.com/?id.347988 Third Party Advisory VDB Entry
https://vuldb.com/?submit.758338 Third Party Advisory VDB Entry