CVE-2026-41452: Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert targeting the hardcoded administrator user ID, enabling full administrative access to all CRM data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Krayin CRMto a version that resolves this vulnerability.Fixed in 2.2.4 - Compensating control
Block or restrict unauthenticated access to the install/api/admin-config-setup endpoint (for example, via firewall/ACL or web server routing rules) so external clients cannot reach it without proper authentication.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41452?
CVE-2026-41452 has a critical severity rating of 9.8.
How do I fix CVE-2026-41452?
To fix CVE-2026-41452, ensure that the installation API does not allow unauthenticated access by implementing proper authentication mechanisms.
What vulnerabilities does CVE-2026-41452 exploit?
CVE-2026-41452 exploits missing authentication to allow unauthenticated attackers to take control of the primary administrator account.
Which version of Krayin CRM is affected by CVE-2026-41452?
Krayin CRM version 2.2.4 is affected by CVE-2026-41452.
What impact does CVE-2026-41452 have on Krayin CRM users?
CVE-2026-41452 allows attackers to overwrite the primary administrator account, potentially compromising the entire system.