Which versions of Krayin CRM are affected by CVE-2026-61460?

Krayin CRM through version 2.2.3 has a critical authorization flaw allowing any employee with system access to view, modify, reassign, or delete customer records, leads, quotes, and activities…

Is there a public PoC exploit available for CVE-2026-61460?

Yes, a public proof-of-concept exploit is available for CVE-2026-61460. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-61460?

Within 24 hours: (1) Identify all systems running Krayin CRM and confirm version (through 2.2.3 affected); (2) Audit user account activity and access logs for suspicious record modifications; (3) Disable or restrict non-essential CRM user accounts. Within 7 days: (1) Implement read-only access restrictions by user role; (2) Deploy enhanced logging of all record create/update/delete operations; (3) Contact Krayin vendor for remediation timeline; (4) Evaluate alternative CRM platforms if patch timeline is unclear. Within 30 days: (1) Apply vendor patch immediately upon release; (2) Conduct full audit of CRM records modified during exposure window; (3) Notify customers if their records were accessed or altered.

Krayin CRM CVE-2026-61460

Q: What is the CVSS score of CVE-2026-61460?

CVE-2026-61460 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42981 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-10 VulnCheck

GHSA-9qgj-r9fj-454p

Authentication Bypass Laravel Crm Krayin

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web app exploitable by any authenticated low-privilege user (PR:L) with no interaction; full read/modify/delete of other users' records yields high C/I/A, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 19:15 vuln.today

DescriptionCVE.org

Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, update, and destroy methods.

AnalysisAI

Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper with leads, persons, organizations, quotes, and activities belonging to other users. Because the edit, update, and destroy methods across five controllers never verify record ownership, a low-privileged account can read, modify, reassign, or delete arbitrary CRM records by manipulating the object ID. Publicly available exploit details exist (reported by VulnCheck), though the issue is not listed in CISA KEV and no EPSS score was provided.

Technical ContextAI

Krayin CRM is an open-source customer-relationship-management platform built on the PHP Laravel framework. The flaw is a classic Insecure Direct Object Reference (CWE-639, Authorization Bypass Through User-Controlled Key): the application uses a client-supplied primary key (record ID) to look up and act on CRM entities without an accompanying ownership/authorization check. The affected code paths are the edit(), update(), and destroy() controller actions in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController. Because Laravel route-model binding resolves the record purely from the ID in the URL, the missing record-level policy check means the server trusts that whoever is authenticated is entitled to the referenced object. The affected CPE is cpe:2.3:a:krayin:laravel-crm covering all versions.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - monitor and apply the change from https://github.com/krayin/laravel-crm/pull/2567 and upgrade to the first tagged release above 2.2.3 that incorporates it once published. The correct fix is to enforce record-level ownership in the edit, update, and destroy methods of LeadController, PersonController, OrganizationController, QuoteController, and ActivityController - e.g. add Laravel authorization policies (Gate/Policy) or scope queries to the authenticated user's owned records so a mismatched owner returns 403. As a compensating control until patched, restrict CRM accounts to trusted users only, disable self-service registration, minimize the number of low-privilege accounts, and audit application logs for cross-user edits/deletes and unexpected ownership reassignments; note these controls reduce but do not eliminate risk since any authenticated user remains capable of exploitation. Track the vendor issue at https://github.com/krayin/laravel-crm/issues/2559 and the VulnCheck advisory at https://www.vulncheck.com/advisories/krayin-crm-insecure-direct-object-reference-via-controllers.