CVE-2026-38529: High severity Webkul krayin crm vulnerability
A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38529?
CVE-2026-38529 is considered a high-severity vulnerability due to its potential for full account takeover.
How do I fix CVE-2026-38529?
To fix CVE-2026-38529, update your Webkul Krayin CRM to the latest version that addresses the Broken Object-Level Authorization issue.
Who is affected by CVE-2026-38529?
CVE-2026-38529 affects all authenticated users of Webkul Krayin CRM version 2.2.x.
What is the impact of CVE-2026-38529?
The impact of CVE-2026-38529 allows authenticated attackers to reset user passwords, leading to potential account takeover.
What components are involved in CVE-2026-38529?
CVE-2026-38529 specifically involves the /Settings/UserController.php endpoint in Webkul Krayin CRM.