CVE-2026-111349 — Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL
Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API…
Published: 2026-10-15 · CVSS: 6.9 · CVSS 4.0
Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7