EUVD-2026-88047
GHSA-cfpc-pq64-98qq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege CRM user
-
ExploitRequest unmapped admin route (e.g. warehouse settings)
-
ExecutionFail-open ACL middleware grants access
-
ImpactPerform unauthorized admin function
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Krayin laravel-crm admin-panel account with a limited/low-privilege role (PR:L). Exploitation targets admin routes that are absent from the acl.php permission map - the pre-2.2.6 Bouncer.php middleware failed open and authorized any unmapped route, and the shipped ACL typo (admin.settings.warehouse.* instead of admin.settings.warehouses.*) specifically left the warehouse settings routes unprotected. Limiting factors: attacker must already have valid credentials to the admin backend, impact is confined to whichever individual admin functions are unmapped (per-function CRUD rather than full compromise), and all affected versions are <=2.2.5; upgrading to 2.2.6 fully closes it. |
| Impact | This is a genuine but moderate-severity broken-access-control flaw, not a high-CVSS-but-hollow issue nor a critical one. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:L/VI:L/VA:L, base 5.3) is internally consistent with the source evidence: the pre-patch Bouncer.php middleware failed OPEN - any admin route absent from the acl.php map was implicitly allowed, and a route-name typo (admin.settings.warehouse.* vs the real admin.settings.warehouses.*) left the warehouse feature unmapped and therefore reachable by any authenticated user. PR:L is well-supported because a valid low-privilege admin session is required (this is authorization escalation, not pre-auth). E:P (proof-of-concept) matches the published advisory. Signals are aligned rather than conflicting: POC is public, but there is NO CISA KEV listing and no EPSS score was provided, indicating no evidence of widespread active exploitation. The low VC/VI/VA impacts reflect that the flaw grants access to individual admin CRUD functions rather than full compromise. Net: a real fix-worthy issue for anyone running Krayin, but priority is bounded by the authenticated prerequisite, limited per-function impact, and niche deployment footprint. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged authenticated account in a Krayin CRM admin panel (e.g. a restricted sales/support role) navigates directly to admin routes that were never covered by the ACL map - such as the mistyped warehouse-settings routes - and the fail-open middleware permits the action. A public proof-of-concept exists (carlosalbertotuma advisory-05, 'Missing Function-Level Authorization'), demonstrating access to functions the user's role should not reach. Exploitation is remote and low-complexity but bounded to the specific unmapped functions rather than a full takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access administrative functions whose routes are missing from the ACL map, including warehouse settings left unprotected by a route-name typo. The pre-2.2.6 Bouncer middleware failed open for unmapped admin routes, so an attacker who already holds valid admin-backend credentials can invoke functions outside their intended role; publicly available exploit code exists, and upgrading to 2.2.6 fixes the issue. Impact is confined to individual unmapped admin functions rather than full system compromise, making this a moderate-severity broken-access-control flaw.
RemediationAI
Vendor-released patch: 2.2.6. Upgrade Krayin laravel-crm to version 2.2.6 or later, which includes commit a399404a388d8ad2700a01349d0d98069c8e85a4 and corrects both the ACL route-name typo and the fail-open Bouncer middleware behavior; see https://github.com/krayin/laravel-crm/releases/tag/v2.2.6 and https://github.com/krayin/laravel-crm/pull/2626. If immediate upgrade is not possible, apply the upstream patch manually or backport the ACL corrections so warehouse routes use the actual plural admin.settings.warehouses.* names, and change Bouncer to deny unmapped admin routes rather than allowing them, but note that an incomplete allowlist can disrupt legitimate admin authentication, account, and UI helper endpoints. As compensating controls, restrict admin-panel access to trusted networks or IP allowlists and audit low-privilege admin roles for unnecessary permissions; blocking unprotected admin.settings.warehouse.* routes at the web server or WAF reduces exposure but prevents legitimate warehouse settings management for all admins until it is reverted. Review the public exploit advisory at https://github.com/carlosalbertotuma/advisory/blob/main/advisory-05-Missing-Function-Level%20Authorization.md for additional indicators.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is Krayin laravel-crm, identified by CPE cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*:*, with the vulnerable component in the Admin package at packages/Webkul/Admin/src/Config/acl.php and the authorization middleware at packages/Webkul/Admin/src/Http/Middleware/Bouncer.php. The root cause is CWE-284 improper access control expressed as missing function-level authorization: the ACL configuration mapped permissions to route names such as admin.settings.warehouse.* while the actual application routes are pluralized as admin.settings.warehouses.*, and the Bouncer middleware only granted a permission when the current route name was present in the role map but did not deny access when the route name was absent. Consequently, any admin route omitted from or mistyped in the ACL map bypassed the intended role check. The 2.2.6 patch changes the middleware to fail closed, authorizes unmapped routes against the nearest mapped ancestor feature, and adds an allowlist for authentication, self-service account, and generic UI helper routes.
Know when Krayin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote low-complexity access with a required low-privilege authenticated session (PR:L); grants limited unauthorized read/modify of specific admin functions (C:L/I:L), no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been published and may be used. Upgrading to version 2.2.6 is sufficient to fix this issue. This patch is called a399404a388d8ad2700a01349d0d98069c8e85a4. The affected component should be upgraded.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the pr
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the ent
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper w
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm)
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RF
Improper privilege management in Krayin laravel-crm up to and including 2.2.5 lets an authenticated back-office user who
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to
Cross-site scripting in Krayin Laravel CRM through 2.2.5 lets an authenticated user with access to the admin configurati
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges
Stored cross-site scripting in Krayin CRM (laravel-crm) up to and including version 2.2.5 lets an authenticated administ
Stored cross-site scripting in Krayin laravel-crm (versions up to and including 2.2.5) lets an authenticated user with a
Stored client-side template injection in Krayin CRM through 2.2.6 allows an authenticated user with rights to create or
Exploit-DB