The vulnerability resides in the MessageSystemController’s edit_message handler, where the application does not validate that the authenticated user owns the message being edited. This missing ownership check allows any logged‑in user to modify any system inbox message, changing properties such as is_del, look, and uid. As a result, an attacker can delete messages, mark them as read, or reassign them to other users without permission, compromising data integrity and potentially disrupting notification workflows. This is an access control flaw (CWE‑639).

The affected product is CRMEB CRMEB, version 6.0.0 and all earlier releases. The flaw appears in the code accessible through the repository links provided and applies to any installation using this version of the software.

With a CVSS score of 5.3 the vulnerability is of medium severity. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog. The attack requires authenticated access; the attacker must log into the application and then submit a request to the edit_message endpoint with the target message identifier. Because ownership is not checked, the request will succeed and alter the message record, allowing deletion, marking as read, or reassignment of notifications. The exploit is straightforward for an insider or a compromised account, and could be leveraged to tamper with user communications or perpetrate social engineering.