CVE-2026-111349: Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL
Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the createcustomer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Operators running Craftplan through version 0.7.5 are exposed if the affected JSON:API or GraphQL interfaces are reachable by unauthenticated users.
What does an attacker need to exploit it?
No account, privileges, or user interaction are required. An attacker only needs network access to submit an anonymous POST request to /api/json/customers or invoke the create_customer GraphQL mutation.
What can an attacker change?
An attacker can create CRM customer records containing attacker-chosen names, contact details, and addresses. The provided information does not indicate that existing customer records can be read, modified, or deleted.
How can I check whether my deployment is affected?
Confirm whether the deployment is running Craftplan 0.7.5 or an earlier version and whether unauthenticated requests can reach POST /api/json/customers or the create_customer GraphQL mutation.