What is the CVSS score of EUVD-2026-22303?

EUVD-2026-22303 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-22303?

Webkul Krayin CRM v2.2.x contains a broken authorization flaw that allows authenticated users to access, modify, and delete contact records belonging to other users, potentially exposing sensitive…

How to fix or mitigate EUVD-2026-22303?

Within 24 hours: Identify all instances of Webkul Krayin CRM v2.2.x in production and document affected systems and user counts. Within 7 days: Implement network segmentation or IP-based access restrictions to limit CRM access to trusted internal networks only, and conduct an audit of contact record access logs for unauthorized modifications. Within 30 days: Contact Webkul for patch availability and release timeline; if patch is unavailable, evaluate migration to alternative CRM solutions or implement custom compensating controls via code review and access control hardening in PersonController.php.

PHP EUVD-2026-22303

| CVE-2026-38532 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-14 mitre

GHSA-2xx8-j85v-j7wh

PHP Authentication Bypass

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 17:00 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 16:00 euvd

EUVD-2026-22303

Analysis Generated

Apr 14, 2026 - 16:00 vuln.today

CVE Published

Apr 14, 2026 - 00:00 nvd

HIGH 8.1

DescriptionCVE.org

A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request.

AnalysisAI

Broken Object-Level Authorization in Webkul Krayin CRM v2.2.x allows authenticated attackers to access, modify, and delete contact records belonging to other users without authorization. The vulnerability exists in the PersonController.php endpoint where insufficient access controls permit low-privileged authenticated users to manipulate arbitrary contact objects via crafted GET requests. No public exploit identified at time of analysis, though the attack vector is network-accessible with low complexity (CVSS:3.1 AV:N/AC:L/PR:L).

Technical ContextAI

Webkul Krayin CRM is a Laravel-based open-source customer relationship management system. The vulnerability is a classic Broken Object-Level Authorization (BOLA) flaw, also known as Insecure Direct Object Reference (IDOR). In the /Contact/Persons/PersonController.php endpoint, the application fails to properly validate whether the authenticated user has permission to access the requested contact resource. This allows attackers to manipulate object identifiers (likely contact IDs) in GET requests to access or modify contacts across organizational boundaries. BOLA vulnerabilities occur when applications rely on user-supplied input to access objects without verifying the requesting user's authorization to perform operations on those specific objects. The Laravel framework provides authorization mechanisms (policies, gates) that were apparently not implemented or were improperly configured in this controller.

RemediationAI

Organizations should immediately review the security advisory at https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38532 for specific remediation guidance. Patch availability per vendor advisory has not been independently confirmed from available data; check the official Krayin repository at https://github.com/krayin/laravel-crm for updates beyond version 2.2.x. As an interim mitigation, implement application-layer access controls to verify that authenticated users can only access contact records they own or are explicitly authorized to view. Consider implementing Laravel authorization policies on the PersonController to enforce object-level permissions before processing GET requests. Audit logs should be reviewed for suspicious enumeration patterns (sequential contact ID access by users). If patching is delayed, restrict access to the CRM application to only trusted users and monitor for abnormal contact access patterns.