Krayin CRM CVE-2026-112287

Requires a valid authenticated Krayin CRM account with a scope-restricted (non-global) permission role that still has access to the Mail module (PR:L). The attacker must supply the numeric ID of an email linked to another user's record to the update, destroy, mass-update, or mass-destroy EmailController endpoints; since IDs are sequential integers, enumeration is trivial. Limiting factors: no unauthenticated access is possible, no attack against default-anonymous surface, and users already granted global scope are acting within their legitimate rights (so the flaw only matters where tenant/role scoping is used as a security boundary). Affected versions are Krayin CRM before 2.2.7; fixed in 2.2.7.

This is a genuine but moderate-priority issue, not an internet-facing critical. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 7.1 (High) and is internally consistent with the description: network-reachable, low attack complexity, no user interaction, but PR:L - exploitation REQUIRES an authenticated, scope-restricted account, so this is an insider/post-compromise privilege-boundary violation rather than an unauthenticated mass-exploit. Impact weighting leans toward integrity (VI:H - attacker can edit, re-send via is_draft=0, trash and permanently delete other users' emails) with secondary confidentiality (VC:L - disclosure of email subject, body, and linked lead/person data); availability is unaffected (VA:N). No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no signal of active or probable near-term exploitation; the realistic threat is a malicious or compromised low-privilege tenant/agent within a shared Krayin instance. Note the input Tag 'Authentication Bypass' conflicts with the actual weakness: CWE-639 and the description describe broken OBJECT-LEVEL AUTHORIZATION (BOLA/IDOR) against already-authenticated users, not an authentication bypass - treat the tag as mislabeled.

A low-privilege, scope-restricted Krayin CRM user (e.g. a sales agent limited to their own records) logs in and iterates over sequential numeric email IDs that belong to colleagues, calling the EmailController update, destroy, mass-update, or mass-destroy endpoints. They read the targeted emails' subject, body and linked lead/person data, silently edit or re-send messages (is_draft=0), and trash or permanently delete records they should never have been able to touch. No public exploit is identified at time of analysis, but exploitation is trivial given a valid restricted account and predictable IDs.