What is the CVSS score of EUVD-2026-22301?

EUVD-2026-22301 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-22301?

Webkul Krayin CRM 2.2.x contains a broken object-level authorization flaw that allows authenticated users to access, modify, and delete leads belonging to other users, creating a multi-tenant data…

How to fix or mitigate EUVD-2026-22301?

Within 24 hours: Identify all Webkul Krayin CRM 2.2.x instances in production and development environments; disable or restrict external API access to LeadController endpoints via WAF or network segmentation. Within 7 days: Implement object-level access control validation at the application layer requiring verified ownership checks on all lead requests; conduct access logs review for unauthorized lead access patterns. Within 30 days: Apply vendor-released patch when available; migrate to Krayin CRM version 3.x or later if supported; deploy automated regression testing for BOLA vulnerabilities on all CRUD endpoints.

PHP EUVD-2026-22301

| CVE-2026-38530 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-14 mitre

GHSA-rm5f-3c25-p4cw

PHP Authentication Bypass

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 17:01 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 16:00 euvd

EUVD-2026-22301

Analysis Generated

Apr 14, 2026 - 16:00 vuln.today

CVE Published

Apr 14, 2026 - 00:00 nvd

HIGH 8.1

DescriptionCVE.org

A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.

AnalysisAI

Broken Object-Level Authorization in Webkul Krayin CRM 2.2.x allows authenticated attackers to read, modify, and permanently delete leads belonging to other users via crafted GET requests to the LeadController endpoint. This multi-tenant access control failure enables horizontal privilege escalation across customer boundaries. Authentication requirements are minimal (PR:L in CVSS vector), and the attack complexity is low with no user interaction required. No public exploit identified at time of analysis, though the vulnerability appears straightforward to exploit given its BOLA nature.

Technical ContextAI

Webkul Krayin is an open-source Laravel-based CRM system written in PHP. This vulnerability stems from Broken Object-Level Authorization (BOLA), also known as Insecure Direct Object Reference (IDOR). The affected LeadController.php endpoint fails to validate whether the authenticated user has permission to access the requested lead object. In multi-tenant CRM systems, each user should only access leads they own or are authorized to view. The absence of proper authorization checks allows attackers to manipulate lead identifiers in GET requests to access arbitrary lead records. The CVSS vector indicates network-based exploitation (AV:N) with low attack complexity (AC:L), requiring only low-level privileges (PR:L) - suggesting any authenticated user account suffices. The vulnerability affects version 2.2.x of the Laravel CRM implementation, specifically the lead management controller component responsible for CRUD operations on customer lead data.

RemediationAI

Upgrade to a patched version of Webkul Krayin CRM beyond the 2.2.x branch when available. Consult the security advisory at https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38530 for specific remediation guidance and patched version information. As an immediate mitigation, implement server-side authorization checks in LeadController.php to validate that the authenticated user owns or has explicit permission to access the requested lead object before performing any read, update, or delete operations. Review all controller methods handling lead operations to ensure proper object-level authorization. Consider implementing a centralized authorization policy using Laravel's Gate or Policy features to enforce consistent access controls across all CRM entities. Audit application logs for suspicious cross-user lead access patterns that may indicate prior exploitation. For production deployments, apply principle of least privilege by restricting user permissions and implementing role-based access controls at both application and database layers.