CRMEB’s verifyAuth() method has a logic flaw where both branches return true, enabling an authentication bypass. As a result, users with sub‑administrator privileges or no assigned roles can reach admin endpoints that should be protected. This flaw can lead to elevated privileges, data exposure, or manipulation of administrative functions caused by unrestricted access to secured routes.

The vulnerability affects CRMEB, specifically all releases up to and including version 6.0.0.

The CVSS score of 8.7 indicates high severity. While an EPSS score is not available, the lack of a KEV listing suggests no widely known exploits yet. The likely attack vector requires an attacker to log in with an account that has either no roles or is a sub‑administrator. Once authenticated, the attacker can exploit the inert role check to access restricted endpoints, bypassing intended authorization controls.