CVE-2026-112287High· 7.1▾ TwilightKrayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attack…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via is_draft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.
laravel-crm < 2.2.7Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112286Medium· 6.5Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints
CVE-2026-112288Low· 3.3Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
CVE-2026-100885High· 7.3A vulnerability was found in Krayin laravel-crm up to 2.2.4
CVE-2026-110629Medium· 6.5VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods
CVE-2026-110630Medium· 6.5VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find
CVE-2026-100883Medium· 6.3A flaw has been found in Krayin laravel-crm up to 2.2.5