EUVD-2026-104287
GHSA-fppf-7fvr-hr9c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as scope-restricted CRM user
-
ExploitCall quote search and lead-products endpoints
-
ExecutionBypass missing per-user data scope check
-
ImpactExfiltrate other users' quotes, pricing, and contact data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid, authenticated Krayin CRM account with restricted (per-user) data scope - i.e., a legitimate but limited user in a multi-user deployment running a version before 2.2.7. The attacker reaches the quote search and lead-products endpoints handled by QuoteController, which fail to apply the per-user data scope filter. No special configuration, feature flag, or user interaction is needed against default multi-user installs. Limiting factors: authentication is mandatory (PR:L, so not exploitable by anonymous internet users), single-tenant/single-user instances have nothing to cross-access, and impact is read-only disclosure of quote/pricing/contact data with no write or availability effect. |
| Impact | This is a CWE-639 insecure direct object reference (broken object-level authorization) in Krayin CRM. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scoring 7.1 is internally consistent with the description: network-reachable web endpoints, low attack complexity, and crucially PR:L - exploitation requires an already-authenticated, scope-restricted account, so this is not an unauthenticated breach. Impact is confined to confidentiality (VC:H, with VI:N/VA:N): read-only disclosure of other users' quote data, with no integrity, availability, or cross-system (SC/SI/SA:N) impact. Exploitation signals are weak: no EPSS probability was supplied, there is no CISA KEV listing, and no public proof-of-concept is present - all references are the vendor patch commit, pull request, release tag, and the VulnCheck advisory, so no public exploit identified at time of analysis. No SSVC decision data was provided. Net assessment: a genuine but moderate-priority insider/low-privilege data-exposure issue rather than a widely-weaponized critical flaw; the headline 7.1 is driven by high confidentiality impact, not by ease of unauthenticated reach. Note the CVSS claims high confidentiality impact while the flaw only leaks quote/pricing/contact metadata - defenders should weigh the sensitivity of CRM data in their environment rather than treating VC:H as catastrophic. |
| Exploit ScenarioDerived | A low-privilege Krayin CRM user whose account is restricted to their own records authenticates normally, then calls the quote search and lead-products endpoints in QuoteController with identifiers belonging to colleagues or other leads. Because the per-user data scope check is missing, the response returns quotes, billing/shipping addresses, totals, contact details, and product pricing owned by other users. No public exploit code is identified at time of analysis; the attack is a straightforward authenticated API request manipulation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Insecure direct object reference in Krayin CRM before 2.2.7 allows an authenticated user with a restricted, per-user data scope to read quotes belonging to other users by querying the quotes search and lead-products endpoints, which fail to apply the per-user scope filter in QuoteController. Successful abuse discloses quote addresses, totals, contact details, and product pricing for any user or lead in the instance. The flaw requires a valid low-privileged account (CVSS v4.0 7.1 as published; independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), is read-only with no integrity or availability impact, and has no public exploit identified at time of analysis. Vendor-released patch: 2.2.7.
RemediationAI
Upgrade Krayin CRM to 2.2.7 or later - the vendor-released patch - by pulling the tagged release (https://github.com/krayin/laravel-crm/releases/tag/v2.2.7) or applying the upstream commit 64b9125f33a7eb2ef9916d0e5fd8215c7f6a8c28 / PR #2683, then run migrations and clear caches as part of the standard Laravel upgrade; validate afterwards with the new QuoteDataScopeTest cases that a restricted user can no longer retrieve another user's lead products or see out-of-scope quotes in search. The advisory at https://www.vulncheck.com/advisories/krayin-crm-before-2.2.7-idor-via-quote-search-and-lead-products-endpoints documents the fix. If immediate upgrading is not possible, compensating controls include temporarily setting all non-administrative users to a global-scope role only if that is acceptable (this does not fix the IDOR and widens legitimate access, so it is not recommended), or more practically suspending restricted-scope accounts in multi-tenant instances until patched, which costs those users their CRM access; fronting the admin panel with a reverse-proxy/WAF rule that rejects requests to the quotes search and lead-products routes from users outside a trusted group reduces exposure but breaks the search UI for those users; and restricting the admin panel to a trusted network segment or VPN limits the attacker pool to insiders. Regardless of mitigation, assume quote addresses, totals, contact details, and pricing may already have been enumerated by any restricted user and review access logs for anomalous quote-id enumeration.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Krayin is an open-source Laravel-based CRM whose admin functionality ships in the Webkul\Admin package; authorization for records such as leads, quotes, and deals is enforced through a per-user data-scope layer that limits non-global users to records they own or that fall inside their assigned scope. CVE-2026-112286 is a CWE-639 authorization bypass through user-controlled key: the QuoteController actions backing the quotes search endpoint and the lead-products endpoint resolve records directly from request parameters without re-applying that data-scope predicate, so a scope-restricted account can enumerate object identifiers it should never see. Because quote records embed customer addresses, contact details, quote totals, and per-line product pricing, the leak is business-sensitive even though no data is modified. The upstream fix commit (64b9125f) and PR #2683 add a QuoteDataScopeTest suite asserting that another user's lead products are refused, that deal pricing is not leaked through lead-products, and that out-of-scope quotes are excluded from search responses and do not disclose subject or totals - indicating the correction is a scope-enforcement change in the controller/query layer rather than an architectural redesign. No CPE strings were supplied with the feed data; affected identification rests on the vendor version boundary (before 2.2.7) and the v2.2.6 source reference.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable web endpoints (AV:N/AC:L) require an authenticated low-privilege account (PR:L), no user interaction, and disclose cross-user data read-only, so C:H with I:N/A:N and S:U.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.
Executive ViewAI
Krayin CRM deployments below version 2.2.7 allow any authenticated low-privileged user to read quotes belonging to other users, exposing customer contact details, deal totals, and product pricing across the instance. The issue is read-only but broad in scope, so leadership should treat it as a customer-confidentiality and pricing-integrity risk rather than an availability event. No public exploit has been identified at time of analysis, yet the low privilege requirement makes abuse by insiders or compromised accounts plausible.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB