Insecure Direct Object Reference Vulnerability in Krayin CRM by Krayin
CVE-2026-112286

7.1HIGH

Key Information:

Vendor

Krayin

Status
Laravel-crm
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112286?

Krayin CRM versions before 2.2.7 are susceptible to an insecure direct object reference vulnerability, enabling authenticated users with restricted scopes to access other users' quotes. This flaw occurs because of inadequate per-user data scope checks within the QuoteController, allowing malicious actors to exploit the quotes search and lead-products endpoints. By doing so, they can retrieve sensitive information such as quote addresses, totals, contact details, and product pricing associated with any user or lead.

Affected Version(s)

laravel-crm 0 < 2.2.7

References

https://github.com/krayin/laravel-crm/pull/2683
patchissue-tracking
https://github.com/krayin/laravel-crm/commit/64b9125f33a7...
patch
https://github.com/krayin/laravel-crm/blob/v2.2.6/package...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adham Mohammed Abd El-Kawi
.