CVE-2026-61460: fallo de gravedad alta en krayin laravel-crm
Krayin CRM Insecure Direct Object Reference via Controllers
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
41Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 8.7epss 0.5%
Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, update, and destroy methods.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
krayin · laravel-crmPoCs públicas encontradas — 1
cve_referencegithub.com/krayin/laravel-crm/issues/2559no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — krayin laravel-crm
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-41452CRITICALKrayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setupEPSS 3.7%CVE-2026-90944HIGHKrayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parseEPSS 0.7%CVE-2026-41453HIGHKrayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead ParameterEPSS 0.5%CVE-2026-97895MEDIUMkrayin laravel-crm User Management UserController.php privileges managementEPSS 0.3%CVE-2026-125374MEDIUMKrayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/DetachEPSS 0.3%CVE-2026-112286HIGHKrayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products EndpointsEPSS 0.3%