Loading story…
Krayin CRM through version 2.2.3 contains a high-severity insecure direct object reference vulnerability, tracked as CVE-2026-61460, that allows authenticated users to access and manipulate records owned by other users. The flaw affects LeadController, PersonController, OrganizationController, QuoteController, and ActivityController, where record-level ownership checks are missing from edit, update, and delete-related methods even though route-level access controls are present.
The issue allows low-privileged attackers to remotely edit, update, delete, and reassign ownership of CRM data, including by changing fields such as user_id. Public reporting said the weakness stems from inconsistent authorization enforcement in controller logic, with some view paths validating ownership while modification paths do not. The vulnerability is classified as CWE-639 and has been rated High severity, with remediation focused on enforcing ownership validation in affected controller methods and upgrading to a patched release.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-61460 was published for an insecure direct object reference vulnerability in Krayin CRM through version 2.2.3. The advisory said missing ownership validation in several controllers lets authenticated users edit, update, delete, and reassign other users' CRM records.
A GitHub issue documented that Krayin CRM's Bouncer middleware enforced route-level ACLs but failed to consistently enforce record-level ownership checks in multiple controller methods. The report included exploit details showing that a user could edit another user's lead and transfer ownership by changing the user_id field.
A report on Krayin CRM stated that a systematic record-level authorization flaw was confirmed on 2026-05-26, affecting Lead, Person, Organization, Quote, and Activity entities. The issue allows authenticated users with limited permissions to access, modify, delete, or reassign records owned by other users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Webkul **Krayin CRM v2.2.x** was assigned two high-severity vulnerabilities, `CVE-2026-38529` and `CVE-2026-38530`, both caused by **Broken Object-Level Authorization (BOLA)** weaknesses in application endpoints. The first flaw affects `/Settings/UserController.php` and allows an authenticated attacker to reset other users’ passwords with a crafted HTTP request, creating a path to full account takeover and broad impact on confidentiality, integrity, and availability. The second flaw affects `/Controllers/Lead/LeadController.php` and lets an authenticated attacker use a crafted `GET` request to access lead records belonging to other users. An attacker can arbitrarily read, modify, and permanently delete those leads, exposing sensitive CRM data and enabling unauthorized manipulation of business records. Public references point to the Krayin CRM GitHub repository and security advisories documenting the issues.
Jun 29, 2026
A critical missing-authentication vulnerability tracked as **`CVE-2026-41452`** affects **Krayin CRM 2.2.4** and allows remote, unauthenticated attackers to seize the primary administrator account. The flaw resides in the product's installer middleware, where a crafted HTTP `POST` request using the `X-Requested-With: XMLHttpRequest` header can bypass the `CanInstall` middleware redirect check and reach the `install/api/admin-config-setup` endpoint. Researchers said the vulnerable endpoint performs an unauthenticated `updateOrInsert` against a hardcoded administrator user ID, letting an attacker set arbitrary administrator name, email, and password values and gain full access to CRM data. The issue has been rated **Critical**, with reported scores of **CVSS 3.1 9.8** and **CVSS 4.0 9.3**; recommended mitigations include updating Krayin CRM, applying vendor patches, and removing or properly securing the installer after deployment.
Aug 3, 2026SBA Research disclosed **CVE-2026-42540**, a medium-severity mass assignment vulnerability in **DFIR-IRIS** that affects versions up to and including `2.4.27`. The flaw allows authenticated users, including administrators, to manipulate API requests and change backend fields that are not meant to be editable through the GUI, exposing sensitive attributes such as asset type IDs, user UUIDs, usernames, account type, account active status, MFA secrets, and MFA activation state. The issue was traced to request data being loaded without strict field allowlisting across multiple endpoints, including asset type add/update functions and user update functionality. The advisory says some unauthorized changes are stopped only by database constraints rather than by application-layer validation, showing that the software still attempts prohibited updates. SBA Research said the bug was fixed in **DFIR-IRIS `2.4.28`** and urged users to upgrade, while also recommending strict allowlists or Data Transfer Objects to limit writable fields. The researchers added that the weakness appears systemic rather than isolated, noting an earlier related flaw, **CVE-2026-22783**, as evidence that mass assignment issues had not been comprehensively remediated across the codebase.
Jun 29, 2026