CVE-2026-41452 is a missing authentication vulnerability in Krayin CRM's installer middleware affecting versions 2.2.4 and earlier (<=2.2.0). The vulnerability allows unauthenticated attackers to bypass the CanInstall middleware redirect by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to the admin-config-setup endpoint. This endpoint performs an unauthenticated updateOrInsert operation targeting a hardcoded administrator user ID, enabling the attacker to overwrite the primary administrator account with arbitrary name, email, and password values. This results in full administrative control over the CRM system.

Successful exploitation grants an unauthenticated attacker full administrative access to the Krayin CRM instance, including all CRM data and administrative functions. This compromises confidentiality, integrity, and availability of the system and its data. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the installer and admin-config-setup endpoints, implement network-level access controls, and monitor for suspicious POST requests with the X-Requested-With: XMLHttpRequest header targeting these endpoints. Do not rely on the CanInstall middleware redirect as a security control.