CVE Intelligence

Webkul Krayin Crm vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Webkul Krayin Crm: 3 record(s), with affected versions and fixes.
cpe:2.3:a:webkul:krayin_crm

CVE-2026-38532 High · 8.1 CWE-639 Apr 14, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Webkul Krayin Crm
A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request.
CVE-2026-38530 High · 8.1 CWE-639 Apr 14, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Webkul Krayin Crm
A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.
CVE-2026-38529 High · 8.8 CWE-269 Apr 14, 2026
Improper Privilege Management in Webkul Krayin Crm
A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.