CVE-2026-90944highCWE-306

CVE-2026-90944: fallo de gravedad alta en krayin laravel-crm

Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear laravel-crm

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.7%
Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Productos afectados
krayin · laravel-crm
CVEs relacionadas — krayin laravel-crm

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-41452CRITICALKrayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setupEPSS 3.7%CVE-2026-61460HIGHKrayin CRM Insecure Direct Object Reference via ControllersEPSS 0.5%CVE-2026-41453HIGHKrayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead ParameterEPSS 0.5%CVE-2026-97895MEDIUMkrayin laravel-crm User Management UserController.php privileges managementEPSS 0.3%CVE-2026-112286HIGHKrayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products EndpointsEPSS 0.3%CVE-2026-97896MEDIUMkrayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scriptingEPSS 0.2%