CVE-2026-112286
laravel-crm: Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints
krayin laravel-crmFrameworks
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.2.7laravel-crmCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.
Text from CVE List
Affected versions 1
- laravel-crmaffected: all versions before 2.2.7CVE List
References 5
- github.com/krayin/laravel-crm/pull/2683Fixvia CVE List
- github.com/krayin/laravel-crm/commit/64b9125f33a7eb2ef9916d0e5fd8215c7f6a8c28Fixvia CVE List
- github.com/krayin/laravel-crm/releases/tag/v2.2.7Fixvia CVE List
- vulncheck.com/advisories/krayin-crm-before-2.2.7-idor-via-quote-search-and-lead-products-endpointsAdvisoryvia CVE List
- github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Admin/src/Http/Controllers/Quote/QuoteController.phpReferencevia CVE List