CVE-2026-90944CWE-306

CVE-2026-90944

High · published September 14, 2026

CVSS v3.1
8.2
EPSS
1%
Percentile
50.7
In the wild
Unconfirmed
What it is

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00660 · 50.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-14T22:20Z
References (6)
https://github.com/krayin/laravel-crm · [email protected]https://github.com/krayin/laravel-crm/blob/v2.2.6/bootstrap/app.php · [email protected]https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Admin/src/Routes/Admin/mail-routes.php · [email protected]https://github.com/krayin/laravel-crm/issues/2560 · [email protected]https://www.vulncheck.com/advisories/krayin-crm-through-2.2.6-unauthenticated-email-injection-via-inbound-parse · [email protected]https://github.com/krayin/laravel-crm/issues/2560 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 1%
    epss
  • 14 SEP 17:52Z
    Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
    cvelistv5