CVE-2026-125374: Krayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/Detach
Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Krayin CRMto a version that resolves this vulnerability.Fixed in 2.2.8
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated Krayin CRM users whose access is restricted to individual or group data scope are able to affect tags on leads owned by users outside that scope. The issue affects Krayin CRM versions before 2.2.8.
What does an attacker need to exploit it?
An attacker needs a valid authenticated account with restricted individual or group data-scope access. No user interaction is required.
What actions can an unauthorized user perform?
They can attach tags to, or detach tags from, leads that are owned by users outside their permitted data scope. The provided information identifies an integrity impact and does not indicate confidentiality or availability impact.
How can teams determine whether they are affected?
Check whether the deployed Krayin CRM version is earlier than 2.2.8 and whether users are assigned individual or group data-scope restrictions. Review lead tag attachment and removal activity for actions performed against leads outside the acting user's assigned scope.