CVE-2025-10390: Crmeb Authorization Bypass Vulnerability

CVE-2025-10390 Overview

CVE-2025-10390 is an improper authorization vulnerability in CRMEB versions up to 5.6.1. The flaw resides in the editAddress function of app/services/user/UserAddressServices.php. Authenticated remote attackers can manipulate the ID argument to modify address records belonging to other users. The issue is classified under [CWE-266] (Incorrect Privilege Assignment). A public exploit has been disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact
Authenticated attackers can alter address data belonging to other CRMEB users by tampering with the ID parameter, leading to integrity loss across user account records.

Affected Products

CRMEB versions up to and including 5.6.1
app/services/user/UserAddressServices.php component
Deployments exposing the editAddress endpoint to authenticated users

Discovery Timeline

2025-09-14 - CVE-2025-10390 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10390

Vulnerability Analysis

The vulnerability exists in the editAddress function within app/services/user/UserAddressServices.php. The function accepts an ID parameter that identifies the address record to update. The code does not verify that the supplied ID belongs to the currently authenticated user. An attacker with a valid low-privilege account can submit arbitrary numeric identifiers and edit address records owned by other accounts.

This pattern is an Insecure Direct Object Reference (IDOR) leading to improper authorization. The CRMEB platform is a commerce framework, so addresses often contain shipping destinations, recipient names, and phone numbers tied to orders. Tampering with these records can redirect shipments or alter customer-facing data without alerting the legitimate account owner.

The EPSS score is 0.337% (25th percentile), reflecting limited observed exploitation activity. However, the vendor did not respond to disclosure, and a public proof of concept exists, increasing the likelihood of opportunistic abuse.

Root Cause

The root cause is a missing ownership check before the database update. The handler trusts the client-supplied ID value and applies the update without correlating the record's owner field to the session identity. This is a classic broken object-level authorization defect [CWE-266].

Attack Vector

The attack is launched over the network against the CRMEB web application. The attacker authenticates as any low-privilege user, then issues a request to the address edit endpoint with an ID value belonging to another user. The server processes the request and overwrites the target record. No user interaction from the victim is required.

A public technical writeup is available in the GitHub disclosure document and indexed in VulDB entry #323825.

Detection Methods for CVE-2025-10390

Indicators of Compromise

Web access logs showing repeated POST requests to the CRMEB address edit endpoint with sequentially incrementing ID parameters from a single session.
Database audit entries showing address record updates where the modifying user_id differs from the record's owner_id.
Customer support tickets reporting unauthorized changes to saved shipping addresses or order delivery details.

Detection Strategies

Deploy application-layer logging that records the authenticated user_id alongside the target object ID for every call to editAddress.
Add anomaly rules to flag accounts editing addresses outside their own ownership scope, even retroactively against historical logs.
Correlate address modifications with subsequent order shipping changes to surface fraudulent redirection chains.

Monitoring Recommendations

Monitor the CRMEB application logs for high-frequency calls to UserAddressServices::editAddress from any single session.
Track integrity changes on the user address table and alert when the actor identity does not match the record owner.
Review WAF telemetry for parameter fuzzing patterns against numeric ID fields on user-scoped endpoints.

How to Mitigate CVE-2025-10390

Immediate Actions Required

Restrict access to the CRMEB address management endpoints behind additional authorization middleware that validates record ownership.
Audit the address records table for recent modifications and notify affected customers of any unauthorized changes.
Rotate session tokens and review accounts that have edited multiple distinct address IDs in short time windows.

Patch Information

As of the last NVD update on 2026-04-29, the vendor has not published a patch and did not respond to the original disclosure. Operators running CRMEB 5.6.1 or earlier should implement compensating controls and track the VulDB advisory for vendor updates.

Workarounds

Modify the editAddress function in app/services/user/UserAddressServices.php to verify that the record's owner_id matches the authenticated user_id before applying the update.
Place the address edit route behind a server-side ownership filter that queries the address by both ID and current session user, returning 403 on mismatch.
Deploy WAF rules that block requests to the address edit endpoint when the ID parameter is not bound to the session user via a server-issued token.

bash

# Configuration example
# Pseudo-code ownership check to add in UserAddressServices.php editAddress
# if (UserAddress::where('id', $id)->where('uid', $authUserId)->doesntExist()) {
#     return response()->json(['error' => 'Forbidden'], 403);
# }