Krayin CRM CVE-2026-112286

Requires a valid, authenticated Krayin CRM account with restricted (per-user) data scope - i.e., a legitimate but limited user in a multi-user deployment running a version before 2.2.7. The attacker reaches the quote search and lead-products endpoints handled by QuoteController, which fail to apply the per-user data scope filter. No special configuration, feature flag, or user interaction is needed against default multi-user installs. Limiting factors: authentication is mandatory (PR:L, so not exploitable by anonymous internet users), single-tenant/single-user instances have nothing to cross-access, and impact is read-only disclosure of quote/pricing/contact data with no write or availability effect.

This is a CWE-639 insecure direct object reference (broken object-level authorization) in Krayin CRM. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scoring 7.1 is internally consistent with the description: network-reachable web endpoints, low attack complexity, and crucially PR:L - exploitation requires an already-authenticated, scope-restricted account, so this is not an unauthenticated breach. Impact is confined to confidentiality (VC:H, with VI:N/VA:N): read-only disclosure of other users' quote data, with no integrity, availability, or cross-system (SC/SI/SA:N) impact. Exploitation signals are weak: no EPSS probability was supplied, there is no CISA KEV listing, and no public proof-of-concept is present - all references are the vendor patch commit, pull request, release tag, and the VulnCheck advisory, so no public exploit identified at time of analysis. No SSVC decision data was provided. Net assessment: a genuine but moderate-priority insider/low-privilege data-exposure issue rather than a widely-weaponized critical flaw; the headline 7.1 is driven by high confidentiality impact, not by ease of unauthenticated reach. Note the CVSS claims high confidentiality impact while the flaw only leaks quote/pricing/contact metadata - defenders should weigh the sensitivity of CRM data in their environment rather than treating VC:H as catastrophic.

A low-privilege Krayin CRM user whose account is restricted to their own records authenticates normally, then calls the quote search and lead-products endpoints in QuoteController with identifiers belonging to colleagues or other leads. Because the per-user data scope check is missing, the response returns quotes, billing/shipping addresses, totals, contact details, and product pricing owned by other users. No public exploit code is identified at time of analysis; the attack is a straightforward authenticated API request manipulation.