CVE-2026-112286: Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints

Q: Who can exploit this issue?

An authenticated user with a scope-restricted account can exploit it. The attack can be performed remotely with low complexity and does not require user interaction.

Q: What information could be exposed?

An attacker may read quotes belonging to other users or leads, including quote addresses, totals, contact details, and product pricing. The stated impact is high confidentiality impact, with no integrity or availability impact.

Q: Which application interfaces are involved?

The affected paths are the quote search and lead-products endpoints handled by QuoteController. They can be used to bypass per-user data-scope checks.

Q: Which versions are affected?

Krayin CRM versions before 2.2.7 are affected. Upgrading to version 2.2.7 or later addresses the affected version range described here.

Published Oct 19, 2026

Updated

Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.

Affected Software

1 affected component

Krayin CRM<2.2.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Krayin CRM to a version that resolves this vulnerability.
Fixed in 2.2.7

Event History

Oct 19, 2026

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with a scope-restricted account can exploit it. The attack can be performed remotely with low complexity and does not require user interaction.

What information could be exposed?

An attacker may read quotes belonging to other users or leads, including quote addresses, totals, contact details, and product pricing. The stated impact is high confidentiality impact, with no integrity or availability impact.

Which application interfaces are involved?

The affected paths are the quote search and lead-products endpoints handled by QuoteController. They can be used to bypass per-user data-scope checks.

Which versions are affected?

Krayin CRM versions before 2.2.7 are affected. Upgrading to version 2.2.7 or later addresses the affected version range described here.

CVE-2026-112286: Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which application interfaces are involved?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

Which application interfaces are involved?

Which versions are affected?