CVE-2026-111349: Missing Authorization in puemos Craftplan
Description
Craftplan versions up to 0.7.5 have a missing authorization vulnerability in the CRM Customer resource. This flaw allows unauthenticated attackers to create customer records via JSON:API and GraphQL endpoints. Attackers can send anonymous POST requests to insert arbitrary customer data into the operator's CRM system.
CVSS v4.0
Score 6.9medium
Affected software
puemos
Craftplan
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111349 describes a missing authorization vulnerability in puemos Craftplan (<=0.7.5) affecting the CRM Customer resource. The vulnerability permits unauthenticated attackers to create customer records by sending anonymous requests to the JSON:API endpoint /api/json/customers or using the create_customer GraphQL mutation. This allows insertion of attacker-controlled names, contact details, and addresses into the CRM without authentication or authorization checks.
Potential Impact
The vulnerability enables unauthenticated attackers to inject arbitrary customer records into the CRM database. This could lead to data pollution, operational disruption, or potential misuse of the CRM system. There is no indication of data disclosure or privilege escalation from the provided information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoints and monitor for unauthorized customer creation activity.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-15T20:54:28.279Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad14e332cdf04f65660850f
Added to database: 10/15/2026, 22:05:39 UTC
Last enriched: 10/15/2026, 22:19:05 UTC
Last updated: 10/15/2026, 22:19:05 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.