Loading story…
A critical missing-authentication vulnerability tracked as CVE-2026-41452 affects Krayin CRM 2.2.4 and allows remote, unauthenticated attackers to seize the primary administrator account. The flaw resides in the product's installer middleware, where a crafted HTTP POST request using the X-Requested-With: XMLHttpRequest header can bypass the CanInstall middleware redirect check and reach the install/api/admin-config-setup endpoint.
Researchers said the vulnerable endpoint performs an unauthenticated updateOrInsert against a hardcoded administrator user ID, letting an attacker set arbitrary administrator name, email, and password values and gain full access to CRM data. The issue has been rated Critical, with reported scores of CVSS 3.1 9.8 and CVSS 4.0 9.3; recommended mitigations include updating Krayin CRM, applying vendor patches, and removing or properly securing the installer after deployment.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE entry for CVE-2026-41452 was published, identifying the Krayin CRM 2.2.4 installer authentication bypass as remotely exploitable and rating it Critical with CVSS 3.1 9.8 and CVSS 4.0 9.3.
VulnCheck published an advisory describing a missing authentication flaw in Krayin CRM 2.2.4's installer middleware that lets unauthenticated attackers overwrite the primary administrator account via the install/api/admin-config-setup endpoint.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcejivasecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Krayin CRM through version **2.2.3** contains a high-severity insecure direct object reference vulnerability, tracked as **`CVE-2026-61460`**, that allows authenticated users to access and manipulate records owned by other users. The flaw affects **`LeadController`**, **`PersonController`**, **`OrganizationController`**, **`QuoteController`**, and **`ActivityController`**, where record-level ownership checks are missing from edit, update, and delete-related methods even though route-level access controls are present. The issue allows low-privileged attackers to remotely edit, update, delete, and reassign ownership of CRM data, including by changing fields such as **`user_id`**. Public reporting said the weakness stems from inconsistent authorization enforcement in controller logic, with some view paths validating ownership while modification paths do not. The vulnerability is classified as **CWE-639** and has been rated **High** severity, with remediation focused on enforcing ownership validation in affected controller methods and upgrading to a patched release.
Jul 12, 2026
Webkul **Krayin CRM v2.2.x** was assigned two high-severity vulnerabilities, `CVE-2026-38529` and `CVE-2026-38530`, both caused by **Broken Object-Level Authorization (BOLA)** weaknesses in application endpoints. The first flaw affects `/Settings/UserController.php` and allows an authenticated attacker to reset other users’ passwords with a crafted HTTP request, creating a path to full account takeover and broad impact on confidentiality, integrity, and availability. The second flaw affects `/Controllers/Lead/LeadController.php` and lets an authenticated attacker use a crafted `GET` request to access lead records belonging to other users. An attacker can arbitrarily read, modify, and permanently delete those leads, exposing sensitive CRM data and enabling unauthorized manipulation of business records. Public references point to the Krayin CRM GitHub repository and security advisories documenting the issues.
Jun 29, 2026
Newly published CVEs detail severe application-layer vulnerabilities in three widely used web platforms. **Shopizer 3.2.5** is affected by `CVE-2026-36767`, a critical path traversal flaw in the `/content/images/add` endpoint that lets an unauthenticated attacker send a crafted POST request and write arbitrary files to any writable path. **JeeSite 5.15.1** is affected by `CVE-2026-36760`, where the `fileMd5` parameter in `/a/file/upload` can be abused during chunked uploads to traverse directories and write arbitrary files with whitelisted suffixes to attacker-chosen filesystem locations; exploitation requires authenticated access with file upload permissions. A separate high-severity issue, `CVE-2026-36340`, affects **Krayin CRM 2.1.5** and allows remote code execution through the compose email function. The flaw was classified as `CWE-94` and has been fixed in **Krayin CRM 2.1.6**. The Shopizer and JeeSite bugs were both classified as `CWE-22` and carry high-impact CVSS ratings reflecting serious risk to confidentiality and integrity, with Shopizer also exposing availability. Public references for all three issues were added alongside their CVE records, including linked GitHub documentation and issue reports describing the vulnerabilities.
Jun 29, 2026