Email Injection Vulnerability in Krayin CRM by Krayin
CVE-2026-90944

8.8HIGH

Key Information:

Vendor

Krayin

Status
Laravel-crm
Vendor
CVE Published:
14 September 2026

What is CVE-2026-90944?

The Krayin CRM version 2.2.6 is susceptible to an email injection issue due to the exposure of the POST /admin/mail/inbound-parse endpoint without authentication. This vulnerability allows unauthorized attackers to inject arbitrary emails into the system's inbox. By crafting malicious RFC 2822 messages with falsified sender details and headers, attackers can deliver emails with any chosen subject and body, which may include responses to ongoing conversation threads, jeopardizing data integrity and system security.

Affected Version(s)

laravel-crm 0 <= 2.2.6

References

https://github.com/krayin/laravel-crm/issues/2560
issue-tracking
https://github.com/krayin/laravel-crm
product
https://github.com/krayin/laravel-crm/blob/v2.2.6/package...
technical-description

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.