CVE-2026-112286 — Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-…
Published: 2026-10-19 · CVSS: 7.1 · CVSS 4.0
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7