Krayin CRM Installer Authentication Bypass Vulnerability

Krayin CRM version 2.2.4 is affected by a critical missing authentication vulnerability (CVE-2026-41452) located within the installer middleware. An unauthenticated remote attacker can bypass the CanInstall middleware redirect by including a specific HTTP header, 'X-Requested-With: XMLHttpRequest', in a POST request directed at the application's configuration endpoint. This flaw permits the attacker to interact with the 'admin-config-setup' endpoint, which contains an 'updateOrInsert' function targeting the hardcoded primary administrator user ID. By submitting arbitrary name, email, and password values, an attacker can overwrite existing administrator credentials, resulting in full administrative compromise of the CRM instance. This vulnerability is of high concern due to the ease of exploitation and the potential for full data access and administrative control over the target CRM environment.

Impact

Successful exploitation allows unauthenticated remote attackers to gain full administrative access to Krayin CRM instances. This grants the attacker unrestricted access to all stored CRM data, including customer records, sales information, and communications, as well as the ability to modify system settings or further persist within the environment.

Recommendation

• Immediately restrict access to the CRM installer endpoints using network-level controls until the vendor releases a security update for Krayin CRM 2.2.4.
• Audit access logs for unauthorized HTTP POST requests directed to the 'admin-config-setup' URI path, specifically looking for requests containing the 'X-Requested-With: XMLHttpRequest' header originating from unauthorized IP addresses.
• Review administrative user accounts for anomalous changes or unknown credentials that may indicate post-exploitation account takeover.