CVE-2026-112287

7.1High

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity
Weakness: CWE-639

Impact

Authenticated low-privilege users can modify, resend, or permanently delete other users' emails and read their subject, body, and linked lead data. Attackers only need valid login credentials to manipulate records via numeric IDs.

Root cause

The EmailController write endpoints fail to validate ownership or access scope against target email record IDs before performing updates or deletions.

Affected systems

Krayin CRM before 2.2.7

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Fix & remediation

Upgrade to Krayin CRM version 2.2.7 or later; if unable to patch immediately, restrict network access to the admin panel or disable write endpoints in EmailController.

shell

$ composer update krayin/laravel-crm

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via is_draft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112287