{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/krayin-crm--2.2.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:krayin:krayin_crm:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-112287"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Krayin CRM (\u003c 2.2.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Krayin"],"content_html":"\u003cp\u003eKrayin CRM versions prior to 2.2.7 are affected by a Broken Object Level Authorization (BOLA) vulnerability located within the EmailController. This flaw allows an authenticated user, even one with restricted access scopes, to perform unauthorized actions on emails owned by other users. By supplying specific numeric identifiers to affected write-action endpoints, an attacker can modify, re-send, or delete sensitive email communications.\u003c/p\u003e\n\u003cp\u003eThe vulnerability exposes the application to data disclosure and integrity loss, as attackers can gain access to email subjects, bodies, and associated lead or person data. The impacted endpoints include update, destroy, mass-update, and mass-destroy operations. Successful exploitation allows an attacker to re-send emails by toggling the is_draft status to 0, potentially leading to unauthorized communication or data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the Krayin CRM instance with a low-privileged, restricted-scope account.\u003c/li\u003e\n\u003cli\u003eAttacker discovers the numeric IDs of target emails belonging to other users via legitimate application functions or enumeration.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP POST request targeting the \u003ccode\u003eEmailController\u003c/code\u003e write action (e.g., \u003ccode\u003eupdate\u003c/code\u003e or \u003ccode\u003emass-update\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker inserts the victim's email numeric ID into the request parameters to bypass object-level authorization checks.\u003c/li\u003e\n\u003cli\u003eApplication server receives the request and fails to validate that the authenticated user owns the object associated with the provided ID.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eEmailController\u003c/code\u003e processes the request, executing the requested action (edit, delete, or re-send) on the target email.\u003c/li\u003e\n\u003cli\u003eAttacker successfully modifies or destroys the target email, or forces a re-send by setting \u003ccode\u003eis_draft=0\u003c/code\u003e, resulting in unauthorized data disclosure or integrity compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability impacts users of Krayin CRM versions prior to 2.2.7. If exploited, attackers can access, modify, or permanently delete email communication and associated PII linked to leads and persons within the CRM. This compromises the confidentiality and integrity of customer relationship management data, potentially leading to reputational damage or regulatory compliance issues for affected organizations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Krayin CRM to version 2.2.7 or later immediately to patch the BOLA vulnerability in the EmailController.\u003c/li\u003e\n\u003cli\u003eAudit access logs for repetitive attempts to access or modify email resources via \u003ccode\u003eupdate\u003c/code\u003e, \u003ccode\u003edestroy\u003c/code\u003e, \u003ccode\u003emass-update\u003c/code\u003e, or \u003ccode\u003emass-destroy\u003c/code\u003e endpoints, specifically monitoring for requests involving unexpected numeric IDs.\u003c/li\u003e\n\u003cli\u003eReview user permissions and scope restrictions to ensure that only authorized accounts have access to sensitive email management functions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T16:08:36Z","date_published":"2026-10-19T16:08:36Z","id":"https://feed.craftedsignal.io/briefs/2026-10-krayin-crm-bola/","summary":"Krayin CRM versions before 2.2.7 contain a broken object level authorization vulnerability in the EmailController, allowing authenticated users to manipulate or delete emails belonging to other users.","title":"Broken Object Level Authorization in Krayin CRM","url":"https://feed.craftedsignal.io/briefs/2026-10-krayin-crm-bola/"}],"language":"en","title":"CraftedSignal Threat Feed - Krayin CRM (\u003c 2.2.7)","version":"https://jsonfeed.org/version/1.1"}