EUVD-2026-42981
GHSA-9qgj-r9fj-454p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable web app exploitable by any authenticated low-privilege user (PR:L) with no interaction; full read/modify/delete of other users' records yields high C/I/A, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, update, and destroy methods.
AnalysisAI
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper with leads, persons, organizations, quotes, and activities belonging to other users. Because the edit, update, and destroy methods across five controllers never verify record ownership, a low-privileged account can read, modify, reassign, or delete arbitrary CRM records by manipulating the object ID. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Krayin CRM account of any privilege level (CVSS PR:L) and network access to the web application; no user interaction, no admin rights, and no special non-default configuration are needed - the vulnerable edit/update/destroy paths in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController exist in default installs through 2.2.3. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) rates this 8.7 (High): network-reachable, low complexity, no attack requirements, and no user interaction, but requiring low privileges (PR:L) - i.e. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged sales user (or an attacker who registered/obtained any Krayin account) logs in, opens the edit URL for a lead, and increments or substitutes the record ID to target a colleague's high-value lead. The server processes the update or destroy without checking ownership, so the attacker reassigns the lead to themselves, alters its data, or deletes competitors' records - and public exploit details lower the skill needed to do so. |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - monitor and apply the change from https://github.com/krayin/laravel-crm/pull/2567 and upgrade to the first tagged release above 2.2.3 that incorporates it once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: (1) Identify all systems running Krayin CRM and confirm version (through 2.2.3 affected); (2) Audit user account activity and access logs for suspicious record modifications; (3) Disable or restrict non-essential CRM user accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Laravel Crm
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today