Loading story…
Webkul Krayin CRM v2.2.x was assigned two high-severity vulnerabilities, CVE-2026-38529 and CVE-2026-38530, both caused by Broken Object-Level Authorization (BOLA) weaknesses in application endpoints. The first flaw affects /Settings/UserController.php and allows an authenticated attacker to reset other users’ passwords with a crafted HTTP request, creating a path to full account takeover and broad impact on confidentiality, integrity, and availability.
The second flaw affects /Controllers/Lead/LeadController.php and lets an authenticated attacker use a crafted GET request to access lead records belonging to other users. An attacker can arbitrarily read, modify, and permanently delete those leads, exposing sensitive CRM data and enabling unauthorized manipulation of business records. Public references point to the Krayin CRM GitHub repository and security advisories documenting the issues.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On April 14, 2026, CVE-2026-38532 was received by cve@mitre.org for Webkul Krayin CRM v2.2.x. The authenticated BOLA flaw in the PersonController endpoint allows attackers to access, modify, and permanently delete other users’ contact records via crafted GET requests.
On April 14, 2026, CVE-2026-38529 and CVE-2026-38530 were received by cve@mitre.org for Webkul Krayin CRM v2.2.x. The reported issues describe authenticated Broken Object-Level Authorization flaws enabling password resets for other users and unauthorized access to other users' leads.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Krayin CRM through version **2.2.3** contains a high-severity insecure direct object reference vulnerability, tracked as **`CVE-2026-61460`**, that allows authenticated users to access and manipulate records owned by other users. The flaw affects **`LeadController`**, **`PersonController`**, **`OrganizationController`**, **`QuoteController`**, and **`ActivityController`**, where record-level ownership checks are missing from edit, update, and delete-related methods even though route-level access controls are present. The issue allows low-privileged attackers to remotely edit, update, delete, and reassign ownership of CRM data, including by changing fields such as **`user_id`**. Public reporting said the weakness stems from inconsistent authorization enforcement in controller logic, with some view paths validating ownership while modification paths do not. The vulnerability is classified as **CWE-639** and has been rated **High** severity, with remediation focused on enforcing ownership validation in affected controller methods and upgrading to a patched release.
Jul 12, 2026
A critical missing-authentication vulnerability tracked as **`CVE-2026-41452`** affects **Krayin CRM 2.2.4** and allows remote, unauthenticated attackers to seize the primary administrator account. The flaw resides in the product's installer middleware, where a crafted HTTP `POST` request using the `X-Requested-With: XMLHttpRequest` header can bypass the `CanInstall` middleware redirect check and reach the `install/api/admin-config-setup` endpoint. Researchers said the vulnerable endpoint performs an unauthenticated `updateOrInsert` against a hardcoded administrator user ID, letting an attacker set arbitrary administrator name, email, and password values and gain full access to CRM data. The issue has been rated **Critical**, with reported scores of **CVSS 3.1 9.8** and **CVSS 4.0 9.3**; recommended mitigations include updating Krayin CRM, applying vendor patches, and removing or properly securing the installer after deployment.
Aug 3, 2026
Newly published CVEs detail severe application-layer vulnerabilities in three widely used web platforms. **Shopizer 3.2.5** is affected by `CVE-2026-36767`, a critical path traversal flaw in the `/content/images/add` endpoint that lets an unauthenticated attacker send a crafted POST request and write arbitrary files to any writable path. **JeeSite 5.15.1** is affected by `CVE-2026-36760`, where the `fileMd5` parameter in `/a/file/upload` can be abused during chunked uploads to traverse directories and write arbitrary files with whitelisted suffixes to attacker-chosen filesystem locations; exploitation requires authenticated access with file upload permissions. A separate high-severity issue, `CVE-2026-36340`, affects **Krayin CRM 2.1.5** and allows remote code execution through the compose email function. The flaw was classified as `CWE-94` and has been fixed in **Krayin CRM 2.1.6**. The Shopizer and JeeSite bugs were both classified as `CWE-22` and carry high-impact CVSS ratings reflecting serious risk to confidentiality and integrity, with Shopizer also exposing availability. Public references for all three issues were added alongside their CVE records, including linked GitHub documentation and issue reports describing the vulnerabilities.
Jun 29, 2026