CVE-2026-38532: High severity Webkul krayin crm vulnerability
A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38532?
CVE-2026-38532 has a high severity level due to its Broken Object-Level Authorization vulnerability which allows attackers to access sensitive information.
How do I fix CVE-2026-38532?
To fix CVE-2026-38532, update Webkul Krayin CRM to the latest version where the vulnerability has been resolved.
What versions of Webkul Krayin CRM are affected by CVE-2026-38532?
Webkul Krayin CRM version 2.2.x, specifically from 2.2.0 and above, is affected by CVE-2026-38532.
What type of vulnerability is CVE-2026-38532?
CVE-2026-38532 is classified as a Broken Object-Level Authorization (BOLA) vulnerability.
What can an attacker do with CVE-2026-38532?
An attacker can read, modify, and permanently delete any contact owned by other users through a crafted GET request.