CVE-2026-112287
CVE-2026-112287 · Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via is_draft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.
CVSS 7.1 · Alta · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
laravel-crm
- Versiones
- ≥ 0, < 2.2.7: Afectada (semver)
Actualiza a 2.2.7
Fuentes originales
- https://github.com/krayin/laravel-crm/pull/2683
- https://github.com/krayin/laravel-crm/commit/64b9125f33a7eb2ef9916d0e5fd8215c7f6a8c28
- https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Admin/src/Http/Controllers/Mail/EmailController.php
- https://github.com/krayin/laravel-crm/releases/tag/v2.2.7
- https://www.vulncheck.com/advisories/krayin-crm-before-2.2.7-broken-object-level-authorization-in-mail-module
- https://nvd.nist.gov/vuln/detail/CVE-2026-112287