Krayin CRM CVE-2026-41452

The concrete prerequisite is an already-installed Krayin CRM 2.2.4 instance whose installer routes remain reachable, plus a single unauthenticated HTTP POST to the admin-config-setup endpoint carrying the X-Requested-With: XMLHttpRequest header, which is exactly what bypasses the CanInstall middleware redirect. No authentication, no user interaction, and no non-default configuration are required per CVSS PR:N/UI:N/AT:N - the setup route being exposed is the default post-install state. The primary limiting factor is network reachability of the installer endpoint: instances where the installer routes have been removed, blocked at the proxy, or firewalled are not exploitable, and the attack requires network access to the application.

This is a genuine high priority, not an inflated-CVSS artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) describes a network-reachable, low-complexity, unauthenticated, no-interaction attack yielding full confidentiality/integrity/availability impact over the vulnerable system, which is fully consistent with the described unauthenticated account-overwrite primitive. Publicly available exploit code exists and the finding comes from a credible source (VulnCheck), raising practical exploitability. No EPSS score, KEV listing, or SSVC decision data was provided, so widespread-versus-targeted exploitation cannot be quantified; the absence of KEV means no confirmed active exploitation at time of analysis despite the low barrier to entry. The main real-world limiter is that only already-installed instances still exposing the installer routes are affected, and internet exposure of those routes determines the true blast radius.

An attacker discovers an internet-exposed Krayin CRM 2.2.4 instance and sends a single crafted HTTP POST to the admin-config-setup endpoint with the X-Requested-With: XMLHttpRequest header and attacker-chosen name, email, and password. The CanInstall middleware skips its redirect for the AJAX-flagged request, the handler overwrites the hardcoded superadmin account, and the attacker logs in with the new credentials to control all CRM data. Public exploit code for this bypass is available, lowering the skill required.