CVE-2026-90944: Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
Published Sep 14, 2026
·Updated
Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.
Affected Software
1 affected component
Krayin CRM<=2.2.6
Event History
Sep 14, 2026
CVE Published
via MITRE·05:52 PM
Data Sourced
via MITRE·05:52 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:20 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations should be treated as exposed?
Krayin CRM installations through version 2.2.6 are affected if the /admin/mail/inbound-parse endpoint is reachable by an attacker.
2
What does an attacker need to exploit this issue?
The attacker needs network access to send a POST request to the endpoint. No authentication, prior privileges, or user interaction is required.