EUVD-2026-42981
GHSA-9qgj-r9fj-454p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryEnumerate other users' record IDs
-
ExploitSend edit/update/destroy request with foreign ID
-
ExecutionBypass missing ownership check
-
ImpactModify, reassign, or delete records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires an authenticated Krayin CRM account of any privilege level (CVSS PR:L) and network access to the web application; no user interaction, no admin rights, and no special non-default configuration are needed - the vulnerable edit/update/destroy paths in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController exist in default installs through 2.2.3. Exploitation is limited chiefly by the need for valid credentials, so environments that gate account creation and only provision trusted users to a single-tenant instance face materially lower real-world risk than multi-user or self-registration deployments; impact scales with how many other users' records live in the same instance. |
| Impact | The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) rates this 8.7 (High): network-reachable, low complexity, no attack requirements, and no user interaction, but requiring low privileges (PR:L) - i.e. a valid authenticated CRM account. That single gating factor is the main mitigant: this is not an unauthenticated internet-wide risk, but any legitimate low-tier user (or an attacker who obtains one account, e.g. via signup or phishing) can pivot to full read/write/delete over all other users' records. Publicly available exploit material raises practical exploitability, but the absence of a KEV listing and no supplied EPSS score suggest no confirmed mass exploitation to date - consistent with a targeted, insider-or-foothold threat model rather than opportunistic worming. The high confidentiality, integrity, and availability impacts are credible for a CRM holding customer PII and sales data. Net: a real priority for any multi-tenant or multi-user Krayin deployment, with severity scaled by how many users share the instance. |
| Exploit ScenarioDerived | A low-privileged sales user (or an attacker who registered/obtained any Krayin account) logs in, opens the edit URL for a lead, and increments or substitutes the record ID to target a colleague's high-value lead. The server processes the update or destroy without checking ownership, so the attacker reassigns the lead to themselves, alters its data, or deletes competitors' records - and public exploit details lower the skill needed to do so. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 10, 2026
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper with leads, persons, organizations, quotes, and activities belonging to other users. Because the edit, update, and destroy methods across five controllers never verify record ownership, a low-privileged account can read, modify, reassign, or delete arbitrary CRM records by manipulating the object ID. Publicly available exploit details exist (reported by VulnCheck), though the issue is not listed in CISA KEV and no EPSS score was provided.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - monitor and apply the change from https://github.com/krayin/laravel-crm/pull/2567 and upgrade to the first tagged release above 2.2.3 that incorporates it once published. The correct fix is to enforce record-level ownership in the edit, update, and destroy methods of LeadController, PersonController, OrganizationController, QuoteController, and ActivityController - e.g. add Laravel authorization policies (Gate/Policy) or scope queries to the authenticated user's owned records so a mismatched owner returns 403. As a compensating control until patched, restrict CRM accounts to trusted users only, disable self-service registration, minimize the number of low-privilege accounts, and audit application logs for cross-user edits/deletes and unexpected ownership reassignments; note these controls reduce but do not eliminate risk since any authenticated user remains capable of exploitation. Track the vendor issue at https://github.com/krayin/laravel-crm/issues/2559 and the VulnCheck advisory at https://www.vulncheck.com/advisories/krayin-crm-insecure-direct-object-reference-via-controllers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Krayin CRM is an open-source customer-relationship-management platform built on the PHP Laravel framework. The flaw is a classic Insecure Direct Object Reference (CWE-639, Authorization Bypass Through User-Controlled Key): the application uses a client-supplied primary key (record ID) to look up and act on CRM entities without an accompanying ownership/authorization check. The affected code paths are the edit(), update(), and destroy() controller actions in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController. Because Laravel route-model binding resolves the record purely from the ID in the URL, the missing record-level policy check means the server trusts that whoever is authenticated is entitled to the referenced object. The affected CPE is cpe:2.3:a:krayin:laravel-crm covering all versions.
Know when Krayin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable web app exploitable by any authenticated low-privilege user (PR:L) with no interaction; full read/modify/delete of other users' records yields high C/I/A, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, update, and destroy methods.
Executive ViewAI
Krayin CRM through version 2.2.3 has a critical authorization flaw allowing any employee with system access to view, modify, reassign, or delete customer records, leads, quotes, and activities belonging to other users. This breaks data integrity across all core business functions, enabling unauthorized access to sensitive customer information and disruption of sales and account management operations. Organizations using this product face immediate risk of data tampering, potential customer impact, and compliance violations if records are altered or deleted.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict CRM user provisioning to essential personnel only; (2) Implement object-level access logging via application monitoring; (3) Enforce read-only access for non-sales roles; (4) Deploy database activity monitoring to detect unauthorized record modifications; (5) Isolate CRM network segment with restricted user access; (6) Require multi-factor authentication for all CRM access; (7) Consider temporary disable of edit/update/delete functionality until patched.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the pr
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the ent
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm)
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RF
Improper privilege management in Krayin laravel-crm up to and including 2.2.5 lets an authenticated back-office user who
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access a
Cross-site scripting in Krayin Laravel CRM through 2.2.5 lets an authenticated user with access to the admin configurati
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges
Stored cross-site scripting in Krayin CRM (laravel-crm) up to and including version 2.2.5 lets an authenticated administ
Stored cross-site scripting in Krayin laravel-crm (versions up to and including 2.2.5) lets an authenticated user with a
Stored client-side template injection in Krayin CRM through 2.2.6 allows an authenticated user with rights to create or
Exploit-DB