Read the docs
TI-2026-76486 Aliases CVE-2026-112286GHSA-fppf-7fvr-hr9c

Insecure direct object reference in Krayin CRM exposes other users' quotes

Priority LOW 31CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Krayin CRM before 2.2.7 contains an insecure direct object reference that lets authenticated users with restricted scope read other users' quotes. The flaw, tracked as CWE-639, lies in QuoteController, which skips per-user data scope checks. An attacker with low privileges can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details and product pricing belonging to any user or lead.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0025 16th percentileScored 2026-11-07
Fix Fixed laravel-crm (krayin): 2.2.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
krayinlaravel-crmbefore 2.2.72.2.7Patch availableCNA
  • laravel-crm Vendorkrayin Affected before 2.2.7 Fixed in 2.2.7 Patch available CNA

Remediation

Upgrade laravel-crm to version 2.2.7, which fixes the flaw. CISA has not added this vulnerability to its Known Exploited Vulnerabilities catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA laravel-crm (krayin) Fixed in 2.2.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    krayin laravel-crm 2.2.7

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-76487 Broken object level authorization in Krayin CRM mail modulePriority LOW 31
    • TI-2026-76488 SSRF filter bypass via DNS rebinding in Krayin CRM webhooksPriority LOW 11
    Show all 3 records →

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-112286
  2. 2026-10-19 Alias added: GHSA-fppf-7fvr-hr9c

References

Patch 2

Other 2

  • TI-2026-30041 Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup CVSS 4.0CRITICAL 9.3
  • TI-2026-61808 Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse CVSS 4.0HIGH 8.8
  • TI-2026-44065 Krayin CRM Insecure Direct Object Reference via Controllers CVSS 4.0HIGH 8.7
  • TI-2026-30042 Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter CVSS 4.0HIGH 8.7
  • TI-2026-65023 Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization CVSS 4.0MEDIUM 6.9
  • TI-2026-64295 krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting CVSS 4.0MEDIUM 5.1
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences