CVE-2026-112286: Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Krayin CRMto a version that resolves this vulnerability.Fixed in 2.2.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with a scope-restricted account can exploit it. The attack can be performed remotely with low complexity and does not require user interaction.
What information could be exposed?
An attacker may read quotes belonging to other users or leads, including quote addresses, totals, contact details, and product pricing. The stated impact is high confidentiality impact, with no integrity or availability impact.
Which application interfaces are involved?
The affected paths are the quote search and lead-products endpoints handled by QuoteController. They can be used to bypass per-user data-scope checks.
Which versions are affected?
Krayin CRM versions before 2.2.7 are affected. Upgrading to version 2.2.7 or later addresses the affected version range described here.