Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-1734: Zhong Bang CRMEB allows remote actions without permission

CVE-2026-1734 · published 9 months ago

Summary

The CRMEB system (versions up to 5.6.3) includes a flaw in its scheduled‑task controller that does not properly check who is allowed to use it. Because the check is missing, an attacker on the internet can trigger tasks or retrieve data they should not access. Upgrade to a patched version or apply the vendor’s recommended fix as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
crmeb	crmeb	<= 5.6.3 `cpe:2.3:a:crmeb:crmeb::::::::`

Original advisory text

Zhong Bang CRMEB crontab Endpoint CrontabController.php authorization

A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3. This vulnerability affects unknown code of the file crmeb/app/api/controller/v1/CrontabController.php of the component crontab Endpoint. The manipulation results in missing authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References

https://github.com/foeCat/CVE/blob/main/CRMEB/crontab_unauthorized_access.md URL
https://vuldb.com/?id.343633 Vendor Advisory
https://vuldb.com/?submit.736619 Vendor Advisory
https://vuldb.com/?ctiid.343633 Third Party Advisory
https://github.com/foeCat/CVE/blob/main/CRMEB/crontab_unauthorized_access.md#pro... Exploit
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1734.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-1734 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

CWE-863Incorrect Authorization

Timeline

Published1 Feb 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-1734 · NVD

CVE-2026-1734 · OSV

Track software like this

Free during beta