Craftplan CVE-2026-111349

No special conditions beyond network reachability - remote unauthenticated exploitation against a Craftplan instance (through 0.7.5) whose JSON:API (POST /api/json/customers) or GraphQL endpoint (create_customer mutation) is exposed to the attacker. The limiting factors are deployment-driven rather than technical: the instance's API must be network-reachable to the attacker, and impact is confined to CREATING new CRM customer records - the flaw does not grant read access to existing customer data, nor the ability to modify or delete existing records, so the realistic worst case is CRM data pollution/spam rather than compromise of confidentiality or system availability.

This is a genuine but modest-severity integrity-only issue, not a top priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability with no user interaction, which is why it scores 6.9 - the attack surface is maximally open. However, impact is deliberately narrow: VI:L with VC:N and VA:N means the only consequence is that an attacker can INSERT attacker-chosen customer records; there is no data disclosure, no modification/deletion of existing records implied, and no availability loss. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public exploit code is referenced, so there is no evidence of active exploitation or weaponization - exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (easy to reach, limited to low-integrity write), so there is no network-vs-local contradiction to resolve. Real-world risk is driven far more by the product's tiny deployment footprint than by the flaw itself: a trivially exploitable write primitive into an obscure open-source CRM is a data-pollution/spam nuisance, not a widespread threat.

An attacker, without any account or token, sends an anonymous HTTP POST to /api/json/customers (or issues the create_customer GraphQL mutation) against an internet-exposed Craftplan instance and injects fabricated customer names, contact details, and addresses into the operator's CRM. Because the request requires no authentication and no user interaction, it is scriptable for bulk record injection (CRM spam/poisoning). No public proof-of-concept is referenced, though the HackMD writeup and VulnCheck advisory describe the exact endpoints.