Broken Object Level Authorization in Krayin CRM by Krayin
CVE-2026-125374

5.3MEDIUM

Key Information:

Vendor

Krayin

Status
Laravel-crm
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125374?

Krayin CRM versions before 2.2.8 are impacted by a broken object level authorization vulnerability, allowing authenticated users, restricted to specific individual or group data scopes, to manipulate tags on leads that they do not own. This flaw exists in the Lead TagController's attach and detach actions, which bypass required data-scope checks, potentially exposing sensitive lead information and allowing unauthorized access.

Affected Version(s)

laravel-crm 0 < 2.2.8

References

https://github.com/krayin/laravel-crm/commit/3cfa2f763563...
patch
https://github.com/krayin/laravel-crm
product
https://github.com/krayin/laravel-crm/blob/999b596d0f53cb...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
Vikas Vishwakarma
.