Which versions of Krayin CRM are affected by CVE-2026-41452?

Krayin CRM 2.2.4 contains a critical vulnerability with publicly available exploit code enabling remote attackers to seize administrative control and access all customer relationship data through an…

Is there a public PoC exploit available for CVE-2026-41452?

Yes, a public proof-of-concept exploit is available for CVE-2026-41452. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2026-41452?

Within 24 hours, identify all Krayin CRM 2.2.4 instances in your environment and restrict network access to authorized personnel; if the installation interface remains exposed, immediately disable or password-protect the /installer and admin-config-setup endpoints. Within 7 days, implement network segmentation to isolate the CRM from untrusted networks, deploy Web Application Firewall rules to block requests to vulnerable endpoints, and establish real-time alerting on POST requests to these paths. Within 30 days, prepare for upgrade once a patched version is available from Krayin or plan migration to an alternative CRM platform; conduct comprehensive audit of all administrative accounts and reset credentials for any systems that may have been exposed during the exposure window.

Krayin CRM CVE-2026-41452

Q: What is the CVSS score of CVE-2026-41452?

CVE-2026-41452 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-52339 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-08-03 VulnCheck

GHSA-9px7-3p6g-6q64

Authentication Bypass Laravel Crm Krayin

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Single unauthenticated network POST with no user interaction (AV:N/AC:L/PR:N/UI:N) overwrites the admin account, giving full C/I/A over the CRM; scope unchanged as impact stays within the app.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 17:09 vuln.today

CVE Published

Aug 03, 2026 - 15:43 cve.org

CRITICAL 9.3

DescriptionCVE.org

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert targeting the hardcoded administrator user ID, enabling full administrative access to all CRM data.

AnalysisAI

Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the primary admin account by POSTing to the installer's admin-config-setup endpoint with an X-Requested-With: XMLHttpRequest header that defeats the CanInstall middleware redirect. Reported by VulnCheck with a publicly available exploit, it carries a 9.3 CVSS 4.0 and grants full control over all CRM data. There is no public exploit identified as actively exploited in CISA KEV, but working exploit code exists.

Technical ContextAI

Krayin is an open-source CRM built on the Laravel PHP framework (CPE cpe:2.3:a:krayin:laravel-crm). The root cause is CWE-306 (Missing Authentication for a Critical Function): the installer's admin-config-setup route is meant to run only during first-time setup, guarded by the CanInstall middleware which redirects already-installed instances away from setup routes. That guard is bypassable because the middleware's redirect logic is skipped for AJAX-style requests bearing the X-Requested-With: XMLHttpRequest header, leaving the setup handler reachable after installation. The handler then performs an updateOrInsert against a hardcoded administrator user ID using attacker-supplied name, email, and password with no authentication check, so the request rewrites the existing superadmin credentials rather than being rejected.

RemediationAI

No vendor-released fixed version is identified in the provided data, so upgrade to a patched release once Krayin publishes one and monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/krayin-crm-missing-authentication-via-install-api-admin-config-setup) and the Jiva Security write-up (https://jivasecurity.com/writeups/krayin-installer-bypass-account-takeover-cve-2026-41452) for the exact version number. As immediate compensating controls, block or remove the installer routes (the admin-config-setup and related install endpoints) at the web server or firewall on any already-installed instance, since they should never be reachable post-installation; restrict access to these paths to trusted admin IPs if they cannot be fully removed. Additionally, strip or reject the X-Requested-With: XMLHttpRequest header on requests to installer paths at a reverse proxy so the CanInstall redirect cannot be bypassed, and rotate the primary administrator credentials after applying controls in case the account was already overwritten. The trade-off is that blocking installer routes will break any legitimate re-installation flow until temporarily re-enabled, and header filtering must be scoped narrowly to installer paths to avoid breaking legitimate AJAX functionality elsewhere in the CRM.