What is the CVSS score of CVE-2026-38529?

CVE-2026-38529 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-38529?

Webkul Krayin CRM v2.2.x contains a critical authentication bypass flaw that allows any authenticated user to reset passwords for arbitrary accounts, resulting in complete account compromise across…

How to fix or mitigate CVE-2026-38529?

Within 24 hours: Inventory all Webkul Krayin CRM v2.2.x deployments and restrict network access to /Settings/UserController.php endpoint via WAF or network controls; disable non-essential user accounts with low privileges. Within 7 days: Implement mandatory multi-factor authentication (MFA) for all CRM user accounts and conduct password reset for all users; review access logs for suspicious password reset activity. Within 30 days: Upgrade to patched Krayin CRM version when vendor releases; apply principle of least privilege to all CRM service accounts.

PHP CVE-2026-38529

EUVD-2026-22300 HIGH

Improper Privilege Management (CWE-269)

2026-04-14 mitre

GHSA-r8rp-5f55-5j9x

PHP Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 17:01 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 16:00 euvd

EUVD-2026-22300

Analysis Generated

Apr 14, 2026 - 16:00 vuln.today

CVE Published

Apr 14, 2026 - 00:00 nvd

HIGH 8.8

DescriptionCVE.org

A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.

AnalysisAI

Authenticated attackers can reset arbitrary user passwords in Webkul Krayin CRM v2.2.x through a Broken Object-Level Authorization (BOLA) vulnerability in the /Settings/UserController.php endpoint, enabling full account takeover of any user account. The attack requires low-privilege authentication (PR:L) and is exploitable remotely with low complexity (AV:N/AC:L), presenting an 8.8 CVSS severity with high impact to confidentiality, integrity, and availability. EPSS data not available; no CISA KEV listing identified; publicly available exploit code exists per researcher disclosure.

Technical ContextAI

Broken Object-Level Authorization (BOLA) vulnerabilities occur when applications fail to validate whether an authenticated user has permission to access or modify specific objects, allowing horizontal privilege escalation. In this case, the /Settings/UserController.php endpoint in Krayin CRM - a Laravel-based open-source customer relationship management application - fails to verify that the authenticated requester has authorization to reset passwords for user objects beyond their own account. The PHP-based endpoint accepts user identifiers in HTTP requests without proper access control checks, allowing any authenticated user to manipulate password reset operations for other users by supplying crafted user IDs. This represents a critical API security flaw where object-level permissions are not enforced at the controller layer, violating the principle of least privilege in multi-tenant or multi-user systems.

RemediationAI

Organizations running Krayin CRM v2.2.x should immediately review the researcher's security advisory at github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38529 for specific remediation guidance and monitor the official Krayin repository at github.com/krayin/laravel-crm for patch releases addressing CVE-2026-38529. Released patched version not independently confirmed from available data. Interim mitigations include implementing additional authorization checks in reverse proxy or web application firewall rules to validate that password reset requests only target the authenticated user's own account, restricting network access to the /Settings/UserController.php endpoint to trusted IP ranges, enabling comprehensive audit logging for all password reset operations to detect unauthorized attempts, and conducting access reviews to ensure low-privilege accounts cannot access administrative settings endpoints. Organizations should upgrade to the patched version immediately upon release and verify that object-level authorization controls are properly implemented across all user management endpoints.