CVE-2026-61460: high-severity vulnerability in krayin laravel-crm
Krayin CRM Insecure Direct Object Reference via Controllers
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.7epss 0.5%
Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, update, and destroy methods.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
krayin · laravel-crmpublic PoCs found — 1
cve_referencegithub.com/krayin/laravel-crm/issues/2559unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — krayin laravel-crm
In the same product, most dangerous first.
CVE-2026-41452CRITICALKrayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setupEPSS 3.7%CVE-2026-90944HIGHKrayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parseEPSS 0.7%CVE-2026-41453HIGHKrayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead ParameterEPSS 0.5%CVE-2026-97895MEDIUMkrayin laravel-crm User Management UserController.php privileges managementEPSS 0.3%CVE-2026-125374MEDIUMKrayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/DetachEPSS 0.3%CVE-2026-112286HIGHKrayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products EndpointsEPSS 0.3%