CVE-2026-113600 | fatfreecrm Fat Free CRM up to 0.25.x Comments CommentsController#update id resource injection

October 20, 2026 Yanac

A vulnerability, which was classified as critical, was found in fatfreecrm Fat Free CRM up to 0.25.x. Affected is the function CommentsController#update of the component Comments. Executing a manipulation of the argument ID can lead to improper control of resource identifiers.

This vulnerability is tracked as CVE-2026-113600. The attack can be launched remotely. No exploit exists.

You should upgrade the affected component.VulDB Recent EntriesRead More