---
id: CVE-2026-112286
title: Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints
summary: >-
  Krayin CRM before 2.2.7 contains an insecure direct object reference
  vulnerability that allows scope-restricted authenticated users to read other
  users' quotes by bypassing per-user data scope checks in QuoteController.
  Attackers can que…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: krayin
product: laravel-crm
affected:
  - laravel-crm < 2.2.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-19T14:19:23.316774Z'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T14:19:36.695Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112286'
references:
  - url: 'https://github.com/krayin/laravel-crm/pull/2683'
  - url: >-
      https://github.com/krayin/laravel-crm/commit/64b9125f33a7eb2ef9916d0e5fd8215c7f6a8c28
  - url: >-
      https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Admin/src/Http/Controllers/Quote/QuoteController.php
  - url: 'https://github.com/krayin/laravel-crm/releases/tag/v2.2.7'
    label: Krayin CRM v2.2.7 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/krayin-crm-before-2.2.7-idor-via-quote-search-and-lead-products-endpoints
    label: >-
      VulnCheck Advisory: Krayin CRM before 2.2.7 IDOR via Quote Search and
      Lead-Products Endpoints
tags:
  - cve.org
ingestedAt: '2026-10-19T14:30:01.061Z'
---

## Overview

Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.

## Affected

- `laravel-crm < 2.2.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.