Threat Intelligence Database

CVE-2026-100885 is an authorization bypass vulnerability in Krayin laravel-crm versions 2.2.0 through 2.2.4. It affects the admin-config-setup API endpoint via the CanInstall.php middleware, allowing unauthenticated remote attackers to bypass authorization controls. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). A public exploit exists. Upgrading to version 2.2.5 mitigates this issue.

A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource identifiers. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.2.6 is sufficient to resolve this issue. The identifier of the patch is 13d6988cda8d69ece45ee1890effc90a7f21cdc1. It is suggested to upgrade the affected component.

A vulnerability in krayin laravel-crm up to version 2.2.5 allows remote attackers to manipulate the role_id argument in the User Management component, leading to improper privilege management. This issue affects the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php. The vulnerability has a CVSS score of 6.3 and is addressed by upgrading to version 2.2.6.

A cross-site scripting (XSS) vulnerability exists in krayin laravel-crm versions up to 2.2.5 in the ConfigurationForm::rules function related to upload functionality. This vulnerability can be exploited remotely and has a low severity score. The issue is fixed in version 2.2.6.

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 is capable of addressing this issue. The patch is identified as 734aa10ae6c2ffa4c96c8869a89aa66940e4d345. You should upgrade the affected component.

A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_id can lead to improper privilege management. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.6 is able to mitigate this issue. This patch is called 5469d70336fbb25e8e513683e82b32982ce8aa82. Upgrading the affected component is advised.

Krayin laravel-crm versions up to 2.2.6 contain a stored client-side template injection vulnerability. Authenticated attackers can inject Vue.js template expressions into the web form description field, which are then compiled by the Vue template compiler. This allows execution of arbitrary JavaScript in the browsers of users who view the affected web form, potentially compromising their session or data. The vulnerability arises from improper neutralization of input during web page generation.

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected product record.

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected person record.

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected lead record.