CVE-2026-61460 — Krayin CRM Insecure Direct Object Reference via Controllers
Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityCon…
Published: 2026-07-10 · CVSS: 8.7 · CVSS 4.0
Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, update, and destroy methods.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7