CVE-2026-38530

Published: Apr 14, 2026Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: MITRE (Secondary)

Description

A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.

Affected (1)

Products: Webkul: Krayin Crm

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Webkul Krayin Crm	Version 2.2.0

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38530

Source: cve@mitre.org

ExploitMitigationThird Party Advisory

https://github.com/krayin/laravel-crm

Source: cve@mitre.org

Product

Timeline

No history available yet.