---
id: CVE-2026-90944
title: >-
  Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint
  without authentication, allowing unauthenticated attackers to inject arbitrary
  emails into the CRM inbox
summary: >-
  Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint
  without authentication, allowing unauthenticated attackers to inject arbitrary
  emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with
  fo…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L'
cwe:
  - CWE-306
vendor: krayin
product: laravel-crm
affected:
  - laravel-crm <= 2.2.6
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T21:17:43.157'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90944'
references:
  - url: 'https://github.com/krayin/laravel-crm'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/krayin/laravel-crm/blob/v2.2.6/bootstrap/app.php'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Admin/src/Routes/Admin/mail-routes.php
    label: disclosure@vulncheck.com
  - url: 'https://github.com/krayin/laravel-crm/issues/2560'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/krayin-crm-through-2.2.6-unauthenticated-email-injection-via-inbound-parse
    label: disclosure@vulncheck.com
  - url: 'https://github.com/krayin/laravel-crm/issues/2560'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T20:22:34.525295Z'
ingestedAt: '2026-09-14T19:13:23.462Z'
epss: 0.00714
epssPercentile: 0.51822
---

## Overview

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.