Craftplan
Monthly
Craftplan versions prior to 0.5.1 expose decrypted SMTP passwords, email API keys, and email API secrets to unauthenticated network attackers via a broken always-allow authorization policy on the Settings JSON:API resource. Exploitation requires only a valid Settings record ID and a standard GET request - no credentials or elevated access are needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low post-enumeration technical barrier makes this a meaningful credential-exposure risk for any internet-facing Craftplan instance.
Unauthenticated attackers can create arbitrary CRM customer records in Craftplan through 0.7.5 by abusing missing authorization on the JSON:API POST /api/json/customers endpoint and the GraphQL create_customer mutation (CWE-862). The issue is remote and requires only network reachability, with impact limited to integrity - insertion of attacker-chosen names, contact details, and addresses into the operator's CRM - without read access to existing records or ability to modify or delete them. Rated CVSS 4.0 6.9 and independently assessed as an integrity-only modest-severity issue, no public exploit identified at time of analysis and no CISA KEV active exploitation is confirmed.
Craftplan versions prior to 0.5.1 expose decrypted SMTP passwords, email API keys, and email API secrets to unauthenticated network attackers via a broken always-allow authorization policy on the Settings JSON:API resource. Exploitation requires only a valid Settings record ID and a standard GET request - no credentials or elevated access are needed. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low post-enumeration technical barrier makes this a meaningful credential-exposure risk for any internet-facing Craftplan instance.
Unauthenticated attackers can create arbitrary CRM customer records in Craftplan through 0.7.5 by abusing missing authorization on the JSON:API POST /api/json/customers endpoint and the GraphQL create_customer mutation (CWE-862). The issue is remote and requires only network reachability, with impact limited to integrity - insertion of attacker-chosen names, contact details, and addresses into the operator's CRM - without read access to existing records or ability to modify or delete them. Rated CVSS 4.0 6.9 and independently assessed as an integrity-only modest-severity issue, no public exploit identified at time of analysis and no CISA KEV active exploitation is confirmed.