Missing Authorization Vulnerability in Craftplan CRM Product

CVE-2026-111349

What is CVE-2026-111349?

The Craftplan CRM product version up to 0.7.5 features a vulnerability that enables attackers to exploit missing authorization controls. This security flaw allows unauthenticated users to create unauthorized customer records through both JSON:API and GraphQL interfaces. By submitting crafted requests to the designated API endpoints, attackers can insert arbitrary names, contact information, and addresses into the CRM without needing valid authentication credentials, leading to potential data manipulation and privacy breaches.

References