Security readout for executives and security teams
Plain-English summary
CVE-2026-3265 is an improper authorization flaw in go2ismail Free-CRM’s Security API. A logged-in remote user may access or affect data or functions they should not. Public proof-of-concept material exists, but the provided sources do not show confirmed active exploitation.
Executive priority
Treat as a near-term application security task if Free-CRM is used. The issue is not KEV-listed, but public exploit information and unclear patch status increase operational concern.
Technical view
The issue affects an unknown part of /api/Security/ in go2ismail Free-CRM up to commit b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. It is mapped to CWE-266 and CWE-285. CVSS v2 is 6.5 with network access, low complexity, and authentication required.
Likely exposure
Organizations running go2ismail Free-CRM, especially deployments exposing the Security API to authenticated users over a network. Version boundaries are unclear because the project uses rolling releases and no fixed release information is provided.
Exploitation context
Sources state the attack can be performed remotely by an authenticated user and that exploit material is publicly available. CISA KEV is not indicated, and the provided sources do not confirm real-world exploitation.
Researcher notes
Evidence is limited to CVE/VulDB records and a public advisory. The affected code path is described only as an unknown part of /api/Security/. Avoid assuming a fixed version; confirm behavior in a controlled, authorized environment.
Mitigation direction
- Check the vendor repository and advisories for updates or authorization fixes.
- Restrict network access to Free-CRM administrative and Security API endpoints.
- Review user roles and remove unnecessary accounts or privileges.
- Monitor Security API activity for unauthorized access patterns.
- Consider compensating controls if no patched release is available.
Validation and detection
- Identify Free-CRM deployments and record the deployed commit or build.
- Determine whether /api/Security/ is reachable by non-administrative authenticated users.
- Review application logs for unusual Security API requests.
- Compare local code against commit b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1 and later changes.
- Track VulDB and CVE updates for clarified affected versions or fixes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-266: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-285: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-3265 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR86.4Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
6.5MediumVector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
Source materials
- CVE List V5 sourceCVE List V5
- VDB-347988 | go2ismail Free-CRM Security API improper authorizationCVE reference · vdb-entry
- VDB-347988 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #758338 | Indotalent Free-CRM v1.0 commit: b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1 Improper AuthorizationCVE reference · third-party-advisory
- https://github.com/Ghufran2/CVE-Free-CRM-Advisories/blob/main/Free-CRM%20IDOR.mdCVE reference · exploit
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Privilege Assignment
Incorrect Privilege Assignment represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Authorization
Improper Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.