The vulnerability is an insecure direct object reference in Fat Free CRM that lets an authenticated attacker change or delete comments belonging to other users. The flaw stems from the CommentsController’s update and destroy actions using an unscoped Comment.find that does not verify ownership. As a result, a user can alter or erase comments attached to contacts, accounts, leads, or opportunities owned by others, compromising data integrity and potentially erasing evidence of interactions.

The impact covers all releases of Fat Free CRM prior to version 0.26.0. The product is maintained by Fat Free CRM and is identified as fatfreecrm:fat_free_crm.

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Attack requires the attacker to be authenticated. A malicious user can enumerate comment IDs sequentially and send PUT or DELETE requests to /comments/:id, thereby modifying or deleting arbitrary comment records. No additional privilege escalation is required beyond the user’s normal credentials. Based on the description, it is inferred that the attack vector is a web API endpoint that accepts HTTP methods.