CVE-2026-112286CWE-639

CVE-2026-112286

Medium · published October 19, 2026

CVSS v3.1

6.5

EPSS

Percentile

15.4

In the wild

Unconfirmed

What it is

Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: 7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00250 · 15.4th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-10-19T18:17Z

References (5)

https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Admin/src/Http/Controllers/Quote/QuoteController.php · [email protected]https://github.com/krayin/laravel-crm/commit/64b9125f33a7eb2ef9916d0e5fd8215c7f6a8c28 · [email protected]https://github.com/krayin/laravel-crm/pull/2683 · [email protected]https://github.com/krayin/laravel-crm/releases/tag/v2.2.7 · [email protected]https://www.vulncheck.com/advisories/krayin-crm-before-2.2.7-idor-via-quote-search-and-lead-products-endpoints · [email protected]

EPSS history

Timeline

21 OCT 03:27Z
EPSS moved — → 0%
epss
19 OCT 13:55Z
Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints
cvelistv5
19 OCT 13:55Z
Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints
cvelistv5