EUVD-2026-22301
GHSA-rm5f-3c25-p4cw
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionNVD
A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.
AnalysisAI
Broken Object-Level Authorization in Webkul Krayin CRM 2.2.x allows authenticated attackers to read, modify, and permanently delete leads belonging to other users via crafted GET requests to the LeadController endpoint. This multi-tenant access control failure enables horizontal privilege escalation across customer boundaries. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all Webkul Krayin CRM 2.2.x instances in production and development environments; disable or restrict external API access to LeadController endpoints via WAF or network segmentation. Within 7 days: Implement object-level access control validation at the application layer requiring verified ownership checks on all lead requests; conduct access logs review for unauthorized lead access patterns. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today