PHP CVE-2026-38529

Authenticated attacker with any user account on Webkul Krayin CRM v2.2.x. Attacker crafts HTTP request to /Settings/UserController.php endpoint to reset arbitrary user passwords. No victim interaction required. Default configurations affected.

This vulnerability presents significant real-world risk despite requiring initial authentication. The CVSS score of 8.8 reflects the severe impact: remote network attack vector (AV:N), low attack complexity requiring no special conditions (AC:L), requiring only low-privilege credentials (PR:L), and resulting in complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). The lack of scope change (S:U) indicates the attacker remains within the same security context, but complete account takeover enables lateral movement to administrative accounts if present. BOLA/IDOR vulnerabilities are consistently ranked in OWASP API Security Top 10 (#1 in 2023) due to widespread occurrence and ease of exploitation. The public availability of exploit details in the researcher's GitHub security advisory significantly lowers the barrier to exploitation. While no EPSS score is available and CISA KEV does not list this CVE, the combination of low technical barrier, publicly documented exploit methodology, and high impact makes this a realistic priority for organizations running Krayin CRM. Authenticated access requirement provides some defense-in-depth, but common scenarios like credential stuffing, phishing, or compromised low-privilege service accounts make the PR:L threshold readily achievable for motivated attackers.

An attacker with valid low-privilege credentials (such as a basic customer account or compromised sales representative login) authenticates to the Krayin CRM application and identifies the password reset functionality in the /Settings/UserController.php endpoint. By intercepting and modifying HTTP requests, the attacker replaces their own user identifier with the target administrator's user ID in the password reset request payload. Due to missing object-level authorization checks, the application processes the request and resets the administrator's password to an attacker-controlled value. The attacker then authenticates as the administrator, gaining full access to the CRM system including sensitive customer data, business relationships, sales pipelines, and administrative configuration. Publicly available exploit code exists per researcher disclosure, providing detailed exploitation methodology that reduces technical barriers for threat actors.