Authentication Bypass in Krayin CRM Inbound Parse Endpoint

Krayin CRM versions through 2.2.6 contain a critical authentication bypass vulnerability identified as CVE-2026-90944. The vulnerability exists within the /admin/mail/inbound-parse endpoint, which fails to enforce authentication checks. This oversight allows remote, unauthenticated attackers to send crafted HTTP POST requests containing arbitrary RFC 2822 formatted messages. By manipulating these requests, an attacker can forge sender information, headers, subjects, and email bodies. Crucially, these messages can be injected directly into existing conversation threads within the CRM, potentially facilitating social engineering, credential harvesting, or internal misinformation campaigns by appearing as legitimate customer or internal communications. This vulnerability poses a significant risk to the integrity of business communications processed through the CRM platform.

Impact

Successful exploitation allows for the injection of arbitrary email content into the CRM system. This can be weaponized to conduct sophisticated social engineering attacks by inserting forged replies into active customer support or sales threads. Organizations relying on Krayin CRM to manage high-trust communications are at risk of data integrity compromise and potential financial or reputational damage if attackers successfully impersonate clients or internal staff.

Recommendation

• Immediately restrict network access to the /admin/mail/inbound-parse endpoint at the web server or firewall level to trusted IP ranges only.
• Audit existing CRM threads for any anomalous or unexpected email entries that may have been injected via this vulnerability.
• Monitor web server access logs for unauthorized POST requests directed to the /admin/mail/inbound-parse endpoint.
• Verify internal Krayin CRM versioning and ensure all instances are upgraded to a version that patches CVE-2026-90944 as soon as the vendor makes such a release available.