CVE-2026-1203

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-1203
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1203.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-1203
Published
2026-01-20T01:02:08Z
Modified
2026-08-12T03:51:24Z
Severity
  • 2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
CRMEB JSON Token LoginServices.php remoteRegister improper authentication
Details

A weakness has been identified in CRMEB up to 5.6.3. The impacted element is the function remoteRegister of the file crmeb/app/services/user/LoginServices.php of the component JSON Token Handler. Executing a manipulation of the argument uid can lead to improper authentication. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1203.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "5.6.0"
                },
                {
                    "last_affected": "5.6.0"
                },
                {
                    "introduced": "5.6.1"
                },
                {
                    "last_affected": "5.6.1"
                },
                {
                    "introduced": "5.6.2"
                },
                {
                    "last_affected": "5.6.2"
                },
                {
                    "introduced": "5.6.3"
                },
                {
                    "last_affected": "5.6.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/crmeb/crmeb

Affected ranges

Type
GIT
Repo
https://github.com/crmeb/crmeb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
a24a96ab34b9fdda0276f084e26f65d5740c1846
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:crmeb:crmeb:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.6.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v2.*
v2.6
v2.6.0
v4.*
v4.4.2
v4.4.4
v4.6.0
v4.7.0
v5.*
v5.2.0
v5.3.0
v5.4.0
v5.6.1
v5.6.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1203.json"