Server-Side Request Forgery Flaw in Krayin CRM by Krayin
CVE-2026-112288

2.1LOW

Key Information:

Vendor

Krayin

Status
Laravel-crm
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112288?

Krayin CRM versions 2.2.5 and earlier are susceptible to a server-side request forgery (SSRF) flaw that can be exploited by users possessing webhook permissions. This vulnerability enables attackers to manipulate the system into accessing internal addresses by employing DNS rebinding techniques. While the WebhookService::isSafeEndpoint() method attempts to validate endpoints, it can be circumvented as attackers can provide a public address, allowing Guzzle to incorrectly resolve the address later on, thus exposing internal services and cloud metadata endpoints to unauthorized access.

Affected Version(s)

laravel-crm 2.2.5 < 2.2.7

References

https://github.com/krayin/laravel-crm/pull/2683
patchissue-tracking
https://github.com/krayin/laravel-crm/commit/64b9125f33a7...
patch
https://github.com/krayin/laravel-crm/blob/v2.2.6/package...
technical-description

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adham Mohammed Abd El-Kawi
.