Critical-risk tools in FavCRM
24 of the 220 tools in FavCRM are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
cancel_bookingDestructiveCancel a booking. Optionally provide a reason.
-
delete_accountDestructiveSoft-delete a CRM account/customer. This releases the primary phone for future reuse while keeping account history for audit.
-
delete_campaignDestructiveDelete a campaign. Only allowed in DRAFT status; sent campaigns are kept for audit history.
-
delete_categoryDestructiveDelete a CMS post category. Posts in the category are not deleted; they are simply unlinked.
-
delete_contactDestructiveDelete a secondary contact. Primary contacts are protected; set another primary contact or delete the account instead.
-
delete_custom_fieldDestructiveDelete a custom field definition and its stored values.
-
delete_dealDestructiveSoft-delete a CRM deal from the sales pipeline.
-
delete_invoiceDestructiveDelete a DRAFT invoice. Only invoices that have never been sent can be deleted; otherwise use void_invoice.
-
delete_knowledge_documentDestructiveSoft-delete a knowledge document. The agent loses access immediately, but the document can be restored with restore_knowledge_document.
-
delete_postDestructiveDelete a CMS post by ID. Soft-deleted posts can be restored with restore_post.
-
delete_post_typeDestructiveDelete a custom post type. Built-in types cannot be deleted. Fails if any posts of this type still exist — delete those first.
-
delete_post_type_fieldDestructiveRemove a field from a post type schema. Blocked when posts of this type still have data in the field unless force=true is passed (orphans the data).
-
delete_promotionDestructiveDelete a promotion. Past usage records are preserved.
-
delete_segmentDestructiveDelete a customer segment.
-
delete_service_packageDestructiveDelete a service package by ID.
-
delete_tagDestructiveDelete a CRM tag and remove it from all tagged entities.
-
delete_taskDestructiveSoft-delete a CRM task.
-
remove_post_blockDestructiveRemove the block at the given index (0-based). All subsequent blocks shift up by one.
-
void_invoiceDestructiveVoid an invoice. Destructive — invoice can no longer be paid or edited; existing payments are preserved as history. Cannot void invoices that are already PAID or VOIDED.
-
cancel_subscriptionFinancialCancel a subscription. Destructive — turns off auto-renew and prevents further billing cycles. Existing paid periods stay valid until end.
-
create_plan_upgrade_linkFinancialCreate a Stripe Checkout link for a new paid subscription, or a Stripe Billing Portal link for an existing Stripe subscription. Use only after the user explicitly asks to upgrad...
-
create_subscriptionFinancialCreate a recurring subscription for a member. Bind to a membership tier or set a custom amount + cycle.
-
enrol_membershipFinancialEnrol a member into a membership tier. Free tiers enrol immediately; paid tiers return PAYMENT_REQUIRED unless skipPriceCheck is set. Use list_tiers first to find the target tier.
-
record_invoice_paymentFinancialRecord a manual payment against an invoice (cash, bank transfer, cheque, card terminal). Updates invoice status to PARTIAL or PAID based on the running total.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.