Krayin CRM 2.2.4 - IDOR
Source Exploit-DB RSS Feed
Not known to be exploited · public exploit available (Exploit-DB) · CVSS 6.9 Medium.
Data as of 10/25/2026, 04:40:11 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.9% chance of exploitation in 30 days – higher than 62% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Public exploits
- 1 Exploit-DB entryPublic attack or detection tooling exists; see Public exploits below.
What to do
AI-suggested
Until a fix is available, restrict access to the installation API endpoint and monitor for unauthorized requests targeting /install/api/admin-config-setup.
Public exploits and detection
Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.
Description
Krayin CRM version 2.2.4 is affected by an Insecure Direct Object Reference (IDOR) vulnerability. This vulnerability allows unauthorized attackers to bypass authentication and configure administrative settings via a specific API endpoint. Exploit code is publicly available demonstrating how to create an admin user without proper authorization.
Impact
An attacker can gain administrative access to the Krayin CRM system without authentication, potentially leading to full system compromise, unauthorized data access, and control over CRM functionalities. This elevates the risk of data breaches and unauthorized administrative actions.
Summary
Krayin CRM 2.2.4 suffers from an IDOR vulnerability (CVE-2026-100885) that permits unauthenticated attackers to access the /install/api/admin-config-setup endpoint and set administrative credentials. The exploit allows attackers to create an admin user by sending a crafted POST request, bypassing normal authentication controls. The vulnerability has been tested on a Docker container running Ubuntu 24.04.4 LTS. Public proof-of-concept exploit code is available, confirming the vulnerability's presence and exploitability in version 2.2.4 and earlier.
Indicators of compromise
Exploit source code
# Exploit Title: Krayin CRM 2.2.4 - IDOR
# Google Dork: inurl:"/admin/login" "Krayin"
# Date: 27/09/2026
# Exploit Author: bl4dsc4n
# Vendor Homepage: https://github.com/krayin/laravel-crm
# Software Link: https://github.com/krayin/laravel-crm/archive/refs/tags/v2.2.4.zip
# Version: ≤ 2.2.4
# Tested on: docker + Ubuntu 24.04.4 LTS
# CVE : CVE-2026-100885
# PoC https://github.com/carlosalbertotuma/advisory/blob/main/advisory-07-Unauthenticated-InstallerBypass.md
#
# docker run -d -p 8888:80 --n…