Broken Object Level Authorization in Krayin CRM Email Module

CVE-2026-112287

What is CVE-2026-112287?

Krayin CRM prior to version 2.2.7 features a broken object level authorization flaw in the EmailController. This vulnerability enables authenticated users with limited scope to exploit the system by manipulating other users' emails using numeric identifiers. Attackers can leverage this weakness to invoke update, destroy, mass-update, or mass-destroy operations on email records, potentially allowing them to edit, re-send, trash, or delete emails. Additionally, the flaw can lead to the disclosure of sensitive information such as email subjects, body content, and associated lead and person data.

References