CVE-2026-61460
Krayin CRM Insecure Direct Object Reference via Controllers
- State
- Published
- Severity
- 8.7 High
- Published
- Jul 10, 2026
- Updated
- Jul 10, 2026
- Reserved
- Jul 9, 2026
Description
Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, update, and destroy methods.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
laravel-crmkrayin |
|
References
- Researcher Disclosuretechnical-descriptionexploit
- Pull Requestissue-tracking
- https://www.vulncheck.com/advisories/krayin-crm-insecure-direct-object-reference-via-controllersthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.