EUVD-2026-88049
GHSA-6xfx-hrf7-3c42
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate installed Krayin CRM instance
-
DeliverySend request to unguarded installer endpoint
-
ExploitBypass CanInstall middleware state check
-
ExecutionRe-run adminConfigSetup/envFileSetup
-
PersistOverwrite config or reset admin credentials
-
ImpactTake over or disrupt CRM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitable against an already-installed Krayin laravel-crm instance (v2.2.4 or earlier) that remains network-reachable and whose installer routes are still served - the flaw is that CanInstall.php middleware and the InstallerController do not abort requests once installation is complete. No authentication, credentials, or user interaction are required (PR:N/UI:N). The main limiting factor is that the target must be a self-hosted deployment left reachable with the installer package present; installs that have removed/blocked the Installer package or that sit behind network restrictions are not exposed. |
| Impact | This is a genuine but moderate-priority issue. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes unauthenticated, network-reachable, low-complexity exploitation with no user interaction, which is the most concerning combination for an internet-facing CRM. The source-code evidence confirms the root cause: InstallerController endpoints (index, envFileSetup, runMigration, runSeeder, adminConfigSetup) lacked an abortIfInstalled() state guard, and the CanInstall.php middleware failed to block these endpoints on an already-installed instance - so an attacker can re-invoke the installer against a live deployment. A public PoC exists (carlosalbertotuma advisory-07), which raises practical risk, but there is no EPSS score and no CISA KEV listing, so there is no evidence of active or widespread exploitation - the PoC availability and active exploitation are distinct signals and only the former is confirmed. The vendor rated impact as VC/VI/VA:L (score 6.9), but this arguably understates worst-case impact: re-running the installer can overwrite .env, re-run migrations/seeders, and reset admin configuration, which could enable full takeover or destructive data loss (higher integrity/availability impact). Net: a real, publicly-exploitable unauthenticated flaw, but confined to a niche self-hosted product with no evidence of mass exploitation, so treat as low-to-medium priority for the small population of affected installs. |
| Exploit ScenarioDerived | An attacker discovers an internet-facing Krayin CRM (v2.2.4 or earlier) that has already been installed and configured. Because the installer endpoints are not blocked post-install, the attacker sends unauthenticated HTTP requests to the admin-config-setup / installer API (e.g. envFileSetup, runSeeder, adminConfigSetup) to overwrite database/environment configuration or reset the administrator account, gaining control or disrupting the application. A public PoC for this unauthenticated installer bypass is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm) 2.2.4 and earlier because the CanInstall middleware and InstallerController never abort once the application has already been installed, an authorization bypass that allows installer functionality to be re-driven on a live instance. Publicly available exploit code exists (a published advisory demonstrating an unauthenticated installer bypass), though there is no confirmed active exploitation (not in CISA KEV); the assessed vector is network-reachable, no privileges, no user interaction, with low confidentiality, integrity, and availability impact. Only self-hosted deployments left network-reachable with the Installer package present are exposed, and the vendor has released a patched version.
RemediationAI
Vendor-released patch: upgrade to Krayin CRM 2.2.5 (https://github.com/krayin/laravel-crm/releases/tag/v2.2.5), which applies the installer guard from commit 89f2916b6a46ff91bd1999ce38158fa0de8b9490 and PR https://github.com/krayin/laravel-crm/pull/2614; teams that cannot move to the release immediately can cherry-pick the abortIfInstalled() checks into InstallerController::index, envFileSetup, runMigration, and runSeeder. Where upgrading is delayed, the highest-value compensating control is to remove or disable the Webkul/Installer package on already-provisioned instances (via Composer) or, if the package must remain, block the installer and admin-config-setup routes at the reverse proxy or web server and restrict them to loopback/administrative networks - the trade-off being that the setup wizard can no longer be reached for legitimate re-installation or repair without first restoring the allow rule. Disabling the installer package is the safer of the two because a route-blocking rule will not protect against path or host-header variations if it is written too narrowly, while re-enabling installation later requires redeployment rather than a configuration change. Confirm the environment is not exposed to the internet during the change window, since public exploit code for this bypass is already available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Krayin CRM is a Laravel-based, PHP/Composer application composed of modular Webkul packages, one of which (Webkul/Installer) ships the web setup wizard used on first deployment. Its CanInstall middleware (packages/Webkul/Installer/src/Http/Middleware/CanInstall.php) is intended to gate installer routes based on whether the app is already installed, but the middleware and the corresponding InstallerController do not consistently terminate requests after installation completes. The result is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), i.e. a request reaches a state-changing endpoint that should no longer be authorized for the caller. The upstream fix (PR #2614, commit 89f2916b6a46ff91bd1999ce38158fa0de8b9490, release v2.2.5) adds an abortIfInstalled() guard to InstallerController::index, envFileSetup, runMigration, and runSeeder. The same patch also hardens unrelated email-attachment handling by moving attachments to the private 'local' disk, resolving the disk via AttachmentRepository::resolveDisk(), detecting MIME type from file contents, and serving files only through an authenticated download route instead of a public storage URL, which is a separate defense-in-depth change rather than the root cause described here.
Know when Krayin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Unauthenticated remote low-complexity access to installer endpoints (AV:N/AC:L/PR:N/UI:N); rated C/I/A:L in line with vendor, though re-install/admin-overwrite could justify higher I/A.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 2.2.5 mitigates this issue. The patch is identified as 89f2916b6a46ff91bd1999ce38158fa0de8b9490. Upgrading the affected component is recommended.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the pr
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the ent
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper w
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RF
Improper privilege management in Krayin laravel-crm up to and including 2.2.5 lets an authenticated back-office user who
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access a
Cross-site scripting in Krayin Laravel CRM through 2.2.5 lets an authenticated user with access to the admin configurati
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges
Stored cross-site scripting in Krayin CRM (laravel-crm) up to and including version 2.2.5 lets an authenticated administ
Stored cross-site scripting in Krayin laravel-crm (versions up to and including 2.2.5) lets an authenticated user with a
Stored client-side template injection in Krayin CRM through 2.2.6 allows an authenticated user with rights to create or