EUVD-2026-88048
GHSA-gxmj-vr4j-8j5c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged CRM user
-
DeliveryRequest attachment-download endpoint with target ID
-
ExploitServer skips permission check on Storage::download
-
ExecutionRetrieve unauthorized email attachment
-
ImpactDisclose sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Resource identifier sanitization
|
| Exploitation Conditions | Requires an authenticated Krayin laravel-crm account (any low-privileged user; PR:L) with network access to the admin panel - no user interaction and no non-default configuration needed. The vulnerable path is the email attachment-download endpoint (admin.mail.attachment_download) backed by Storage::download in EmailController; before v2.2.6 it performed no function-level authorization, so any logged-in user could fetch any attachment by supplying its ID. Exploitation is limited to reading email attachments (confidentiality only) and is gated solely by needing valid credentials; it does not permit modification or denial of service. The fix (v2.2.6) enforces the 'mail.view' permission on the download action. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N, base 5.3) describes a network-reachable, low-complexity insecure direct object reference (IDOR) that requires an authenticated low-privileged account (PR:L) and yields only limited confidentiality impact (VC:L) with no integrity or availability effect. The 'E:P' temporal marker plus the linked carlosalbertotuma advisory (advisory-06) confirm publicly available exploit code exists, but there is no EPSS score and no CISA KEV listing provided, so this is best treated as a real-but-modest priority rather than a critical emergency. The signals are internally consistent: a POC exists, but the requirement for a valid authenticated session and the read-only, single-tenant-attachment nature of the leak cap real-world severity. This is a genuine broken-access-control bug worth patching, not an over-scored issue - but it is far from a mass-exploitation candidate given the authentication precondition and the niche deployment footprint of Krayin. Note the input tags label this 'Information Disclosure,' which is accurate here (VC:L, read-only), unlike some sibling Krayin CVEs. |
| Exploit ScenarioDerived | An authenticated low-privileged Krayin CRM user (e.g., a limited sales agent) requests the email attachment-download endpoint and iterates or guesses the attachment ID parameter, retrieving files attached to emails/mailboxes they were never authorized to view. Because the endpoint lacked function-level authorization, any valid session could pull attachments by ID regardless of ACL. A public POC (carlosalbertotuma advisory-06) documents the exact request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to download email attachments belonging to other mailboxes simply by supplying a different attachment ID to the admin attachment-download endpoint. Exploitation requires only a valid low-privileged account on the admin panel, causes confidentiality loss only (no modification or denial of service), and publicly available exploit code exists, which the CVSS 4.0 vector reflects via its E:P (proof-of-concept) exploit maturity rating. Vendor-released patch: 2.2.6, which enforces the mail.view permission on the download action.
RemediationAI
Upgrade Krayin laravel-crm to version 2.2.6, which contains the vendor fix, or apply the upstream commit 13d6988cda8d69ece45ee1890effc90a7f21cdc1 (PR 2627) if you maintain a fork; the release is published at https://github.com/krayin/laravel-crm/releases/tag/v2.2.6 and the ACL change is in packages/Webkul/Admin/src/Config/acl.php. If immediate upgrade is not possible, the most effective compensating control is to remove or disable the admin.mail.attachment_download route so attachment downloads fail (trade-off: legitimate users can no longer retrieve mail attachments through the UI until patched), and to tightly restrict who holds any account with admin-panel access, since the flaw is only reachable by authenticated users and every valid low-privileged login can exploit it. Because the endpoint returns stored files keyed by a guessable/supplied ID, fronting the admin panel with a WAF rule that blocks or rate-limits requests to the attachment-download path lacking a matching mail.view session can partially reduce exposure, but this is weaker than the permission check introduced in 2.2.6. Additional context and the original report are at https://github.com/krayin/laravel-crm/issues/2624, https://vuldb.com/vuln/410814, and https://vuldb.com/cve/CVE-2026-100884.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Krayin is an open-source CRM built on the Laravel PHP framework, organized into Webkul packages. The affected code path is the email attachment-download endpoint (route admin.mail.attachment_download) implemented through the Storage::download function in packages/Webkul/Admin/src/Http/Controllers/Mail/EmailController.php, whose ACL entry lived in packages/Webkul/Admin/src/Config/acl.php. The root cause maps to CWE-99 (improper control of resource identifiers), the classic IDOR pattern: the endpoint accepted a caller-supplied attachment ID and resolved it to a stored file without verifying that the requesting user was authorized for the mailbox that owned the attachment, so object-level/function-level authorization was absent. The patch (commit 13d6988cda8d69ece45ee1890effc90a7f21cdc1, PR 2627) adds an explicit abort_unless(bouncer()->hasPermission('mail.view'), 401) guard to the download handler, registers admin.mail.attachment_download under the mail.view ACL route map as defense in depth, and adjusts the SanitizeUrl middleware so non-folder routes lacking a route parameter (such as the plain, non-AJAX attachment href) are not incorrectly validated against the folder whitelist. The CPE cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:* confirms the whole laravel-crm product line up to the fixed release is in scope.
Know when Krayin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Authenticated low-privileged network attacker (PR:L) reads unauthorized email attachments via IDOR; read-only so C:L, no integrity or availability impact and unchanged scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource identifiers. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.2.6 is sufficient to resolve this issue. The identifier of the patch is 13d6988cda8d69ece45ee1890effc90a7f21cdc1. It is suggested to upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the pr
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the ent
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper w
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm)
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RF
Improper privilege management in Krayin laravel-crm up to and including 2.2.5 lets an authenticated back-office user who
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access a
Cross-site scripting in Krayin Laravel CRM through 2.2.5 lets an authenticated user with access to the admin configurati
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges
Stored cross-site scripting in Krayin CRM (laravel-crm) up to and including version 2.2.5 lets an authenticated administ
Stored cross-site scripting in Krayin laravel-crm (versions up to and including 2.2.5) lets an authenticated user with a
Stored client-side template injection in Krayin CRM through 2.2.6 allows an authenticated user with rights to create or
Exploit-DB