CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.

CRMEB, an open-source e-commerce management system, contains a critical authentication bypass vulnerability identified as CVE-2026-85212. The flaw resides in the verifyAuth() method within SystemRoleServices.php, where both conditional branches return true, effectively rendering the role check inert. This allows sub-administrators and accounts with no assigned roles to access restricted admin endpoints without proper authorization. The vulnerability affects CRMEB through version 6.0.0 and is classified as a missing authorization issue. Exploitation does not require elevated privileges, making it accessible to any authenticated user regardless of their role. The issue has been reported via GitHub and documented by VulnCheck. No patch details are mentioned in the article, though the vulnerability has been publicly disclosed.