CVE-2026-38529: Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php
A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.
Other sources
Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php
— Packagist
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38529?
CVE-2026-38529 is considered a high-severity vulnerability due to its potential for full account takeover.
How do I fix CVE-2026-38529?
To fix CVE-2026-38529, update your Webkul Krayin CRM to the latest version that addresses the Broken Object-Level Authorization issue.
Who is affected by CVE-2026-38529?
CVE-2026-38529 affects all authenticated users of Webkul Krayin CRM version 2.2.x.
What is the impact of CVE-2026-38529?
The impact of CVE-2026-38529 allows authenticated attackers to reset user passwords, leading to potential account takeover.
What components are involved in CVE-2026-38529?
CVE-2026-38529 specifically involves the /Settings/UserController.php endpoint in Webkul Krayin CRM.