CVE-2026-61460: Krayin CRM Insecure Direct Object Reference via Controllers
Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, update, and destroy methods.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Krayin CRMto a version that resolves this vulnerability.Fixed in 2.2.3 - Compensating control
Restrict access so authenticated users cannot call edit, update, or destroy controller actions for Leads, People, Organizations, Quotes, or Activities that they do not own (implement record-level ownership checks in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61460?
CVE-2026-61460 has a high severity score of 8.8.
What does CVE-2026-61460 vulnerability allow attackers to do?
CVE-2026-61460 allows authenticated users to edit, update, or delete records owned by other users due to an insecure direct object reference.
How can I mitigate CVE-2026-61460?
To mitigate CVE-2026-61460, you should implement proper access controls in Krayin CRM to ensure users can only access their own records.
Which components of Krayin CRM are affected by CVE-2026-61460?
CVE-2026-61460 affects the LeadController, PersonController, OrganizationController, QuoteController, and ActivityController in Krayin CRM.
Is CVE-2026-61460 present in earlier versions of Krayin CRM?
CVE-2026-61460 is present in Krayin CRM version 2.2.3.