CVE-2026-112287 — Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulat…
Published: 2026-10-19 · CVSS: 7.1 · CVSS 4.0
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via is_draft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7