CVE-2026-112287: Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via isdraft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Krayin CRMto a version that resolves this vulnerability.Fixed in 2.2.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user whose access is restricted by scope can exploit it. The attacker needs numeric IDs for other users' email records and can target them through the affected write actions.
What email actions can an attacker perform?
The affected endpoints allow updating, deleting, mass-updating, and mass-deleting email records belonging to other users. An attacker can edit emails, move them to trash, permanently delete them, or re-send a draft by setting is_draft=0.
What information may be exposed?
An attacker can disclose the targeted email's subject and body, along with linked lead and person data.
Which versions should be remediated?
Krayin CRM versions before 2.2.7 are affected. Upgrade to 2.2.7 or later.