N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-9pm8-vwc5-w2hm

GHSA-9pm8-vwc5-w2hm: Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID

Impact

Authenticated users can delete emails imported into the system assigned to another user; where the Email Dropbox is in use.

Patches

Fixed in v0.26.0

Workarounds

Disable use of email dropbox.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-9pm8-vwc5-w2hm

GHSA-9pm8-vwc5-w2hm:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fat_free_crm	rubygems	< 0.26.0	0.26.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Broken Object Level Authorization (BOLA) in the DELETE /emails/:id endpoint of Fat Free CRM. The analysis of the security patch reveals that the EmailsController#destroy action was the source of the vulnerability. The vulnerable code directly fetched an Email record from the database based on the ID provided in the URL parameters (Email.find(params[:id])) and then proceeded to delete it. There were no authorization checks to verify if the user making the request was the owner of the email or had the necessary privileges to delete it. This allowed any authenticated user to delete emails belonging to other users. The fix, identified in commit 0b26f9cb4ea9a7f8056893745a3104f63043786f, introduces proper authorization. The patch adds load_and_authorize_resource to the EmailsController. This is a standard feature of the CanCanCan authorization gem used in the project. This method automatically loads the @email resource and verifies that the current user is authorized to perform the requested action (in this case, destroy) on it. The authorization rules, defined in app/models/users/ability.rb, were also updated to specify that a user can only manage (:manage, which includes :destroy) emails that belong to them (user_id: user.id). This change ensures that the BOLA vulnerability is remediated.

Vulnerable functions

EmailsController.destroy

app/controllers/emails_controller.rb

The `destroy` method in `EmailsController` was vulnerable to Broken Object Level Authorization (BOLA). Prior to the patch, the method would find an email record using `Email.find(params[:id])` and destroy it without verifying if the authenticated user had the permission to delete that specific email. This allowed any authenticated user to delete any email in the system by simply knowing its ID and sending a DELETE request to `/emails/:id`. The patch fixes this by adding `load_and_authorize_resource`, which uses the CanCanCan gem to ensure the user is authorized to perform actions on the requested resource.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.