LOW

GHSA-9pm8-vwc5-w2hm

Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID

Quick fix

GHSA-9pm8-vwc5-w2hm — fat_free_crm: upgrade to the fixed version with the command below.

bundle update fat_free_crm

Details

### Impact

Authenticated users can delete emails imported into the system assigned to another user; where the [Email Dropbox](https://github.com/fatfreecrm/fat_free_crm/wiki/Email-Dropbox) is in use.

### Patches

Fixed in v0.26.0

### Workarounds

Disable use of email dropbox.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/fat_free_crm

Introduced in: 0Fixed in: 0.26.0

Fixbundle update fat_free_crm

References

https://github.com/fatfreecrm/fat_free_crm/security/advisories/GHSA-9pm8-vwc5-w2hm[WEB]
https://github.com/fatfreecrm/fat_free_crm[PACKAGE]