EUVD-2026-87260Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege CRM user
-
ExploitAccess User Management settings
-
ExecutionManipulate role_id / craft over-privileged role
-
ImpactGain administrative permissions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Krayin laravel-crm back-office account (PR:L) with access to the User/Role Management settings area (packages/Webkul/Admin/.../Settings/UserController.php and RoleController.php). The pre-patch code lacks a canManageRole() authorization check and does not prevent a user from editing their own assigned role or creating/updating a role with permissions exceeding their own, enabling privilege escalation. No user interaction from another party is needed, but the attacker must already possess valid credentials to a settings-capable user; unauthenticated exploitation is not possible. |
| Impact | This is a low-priority issue despite being a privilege-management flaw. The vendor/VulDB CVSS 4.0 base score is only 2.1 with all impacts rated Low (VC:L/VI:L/VA:L) and PR:L, meaning an already-authenticated backend user is required. Exploitation status is 'publicly available exploit code exists' (E:P in the 4.0 vector; a third-party advisory is linked) but there is NO CISA KEV listing and NO EPSS score in the input, so there is no signal of widespread or active exploitation - POC availability and active exploitation are distinct, and only the former applies here. Note a tension between the vendor's very low impact rating and the source-code evidence: the patch adds canManageRole() checks preventing a non-administrator from creating/editing roles with permissions beyond their own or editing their own role, which implies a realistic path to full administrative privilege escalation - arguably higher than VC:L/VI:L/VA:L. That impact is nonetheless gated behind authenticated access to the User/Role Management settings area, so the practical risk is contained. Overall: a genuine authenticated privilege-escalation bug, but low real-world urgency given niche product footprint, no KEV, and no active-exploitation evidence. |
| Exploit ScenarioDerived | An authenticated low-privileged Krayin CRM back-office user with access to the User Management settings manipulates the role_id parameter (or crafts/edits a role) to assign themselves or a controlled account permissions beyond their own, effectively escalating toward administrator. A public advisory documenting the technique exists (github.com/carlosalbertotuma/advisory), lowering the skill needed to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Improper privilege management in Krayin laravel-crm up to and including 2.2.5 lets an authenticated back-office user who can reach the Settings > Users/Roles area escalate their own privileges by manipulating the role_id argument handled in packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php. The pre-patch code applies no canManageRole() authorization check and does not block a user from editing the role assigned to their own account or from creating/updating a role carrying permissions broader than their own, so a low-privileged account can grant itself full administrative rights. Publicly available exploit code exists (a proof-of-concept advisory has been published and the issue is tracked on GitHub), while the vendor assigns a modest CVSS 4.0 score of 2.1; exploitation still requires valid credentials for a settings-capable account, so this is a targeted, post-authentication privilege-escalation risk rather than an unauthenticated compromise.
RemediationAI
Vendor-released patch: 2.2.6 - upgrade Krayin laravel-crm to v2.2.6 (release https://github.com/krayin/laravel-crm/releases/tag/v2.2.6), which incorporates the fix introduced by PR https://github.com/krayin/laravel-crm/pull/2621 and commit 5469d70336fbb25e8e513683e82b32982ce8aa82; review the diff before deploying and confirm the canManageRole() gate, the self-role-edit block, and the created_by data-scoping changes are present in your build. If immediate upgrade is not possible, compensate by restricting access to the admin settings routes (users and roles management) to a minimal set of trusted full administrators, since exploitability depends on holding a settings-capable account - the trade-off is reduced delegation flexibility for team leads who legitimately manage sub-users. Additional compensating actions: audit existing roles for permission sets that exceed their creators' own scope and demote them, since the pre-patch code may already have allowed such roles to be created; temporarily disable non-administrator role creation/editing features at the application layer if your deployment exposes them broadly; and enable and review audit logging on role and user update actions to detect manipulation of role_id or permission payloads. Note that the public proof-of-concept advisory (https://github.com/carlosalbertotuma/advisory/blob/main/advisory-01-privesc.md) and the upstream issue thread give attackers a clear reproduction path, so treating exposed settings areas as high-value targets even though the vendor score is low is advisable; no vendor-issued workaround short of upgrading is documented beyond the authorization logic itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Krayin laravel-crm is an open-source Laravel/PHP CRM maintained by Webkul; the vulnerable code lives in the Admin package (Webkul/Admin) under Settings, with the CPE cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:* indicating the affected product family across the 2.2.x line. The root cause is CWE-269 (Improper Privilege Management): the role-management endpoints in RoleController.php and the user-update path in UserController.php accept user-supplied role_id/permission_type/permissions values without verifying that the acting user is entitled to assign them, and without preventing a user from modifying the role bound to their own account. There is also a broader data-scoping gap - the RoleDataGrid and UserDataGrid did not scope listings by the acting user's data scope (created_by), which the upstream fix corrects alongside the authorization checks. The official patch (PR #2621, commit 5469d70336fbb25e8e513683e82b32982ce8aa82, released as v2.2.6) adds a canManageRole() gate that blocks non-administrators from creating or promoting a role to full administrator or granting permissions beyond their own, denies editing/updating one's currently assigned role, records created_by on new roles, and scopes the role and user datagrids so a user only sees roles/users within their data scope. In practical terms the flaw is an authorization logic weakness in Laravel's Admin-package ACL (bouncer) handling, not a memory-safety or injection bug.
Know when Krayin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Authenticated back-office user (PR:L) can escalate to administrator via unchecked role management, yielding high confidentiality/integrity/availability control of the CRM; network-accessible web app, low complexity.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_id can lead to improper privilege management. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.6 is able to mitigate this issue. This patch is called 5469d70336fbb25e8e513683e82b32982ce8aa82. Upgrading the affected component is advised.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the pr
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the ent
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper w
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm)
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RF
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access a
Cross-site scripting in Krayin Laravel CRM through 2.2.5 lets an authenticated user with access to the admin configurati
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges
Stored cross-site scripting in Krayin CRM (laravel-crm) up to and including version 2.2.5 lets an authenticated administ
Stored cross-site scripting in Krayin laravel-crm (versions up to and including 2.2.5) lets an authenticated user with a
Stored client-side template injection in Krayin CRM through 2.2.6 allows an authenticated user with rights to create or
Exploit-DB