Krayin CRM (< 2.2.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/krayin-crm--2.2.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 19 Oct 2026 16:08:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBroken Object Level Authorization in Krayin CRMhttps://feed.craftedsignal.io/briefs/2026-10-krayin-crm-bola/Mon, 19 Oct 2026 16:08:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-krayin-crm-bola/Krayin CRM versions before 2.2.7 contain a broken object level authorization vulnerability in the EmailController, allowing authenticated users to manipulate or delete emails belonging to other users.Krayin CRM versions prior to 2.2.7 are affected by a Broken Object Level Authorization (BOLA) vulnerability located within the EmailController. This flaw allows an authenticated user, even one with restricted access scopes, to perform unauthorized actions on emails owned by other users. By supplying specific numeric identifiers to affected write-action endpoints, an attacker can modify, re-send, or delete sensitive email communications.

The vulnerability exposes the application to data disclosure and integrity loss, as attackers can gain access to email subjects, bodies, and associated lead or person data. The impacted endpoints include update, destroy, mass-update, and mass-destroy operations. Successful exploitation allows an attacker to re-send emails by toggling the is_draft status to 0, potentially leading to unauthorized communication or data exfiltration.

Attack Chain

  1. Attacker authenticates to the Krayin CRM instance with a low-privileged, restricted-scope account.
  2. Attacker discovers the numeric IDs of target emails belonging to other users via legitimate application functions or enumeration.
  3. Attacker crafts an HTTP POST request targeting the EmailController write action (e.g., update or mass-update).
  4. Attacker inserts the victim's email numeric ID into the request parameters to bypass object-level authorization checks.
  5. Application server receives the request and fails to validate that the authenticated user owns the object associated with the provided ID.
  6. The EmailController processes the request, executing the requested action (edit, delete, or re-send) on the target email.
  7. Attacker successfully modifies or destroys the target email, or forces a re-send by setting is_draft=0, resulting in unauthorized data disclosure or integrity compromise.

Impact

The vulnerability impacts users of Krayin CRM versions prior to 2.2.7. If exploited, attackers can access, modify, or permanently delete email communication and associated PII linked to leads and persons within the CRM. This compromises the confidentiality and integrity of customer relationship management data, potentially leading to reputational damage or regulatory compliance issues for affected organizations.

Recommendation

  • Upgrade Krayin CRM to version 2.2.7 or later immediately to patch the BOLA vulnerability in the EmailController.
  • Audit access logs for repetitive attempts to access or modify email resources via update, destroy, mass-update, or mass-destroy endpoints, specifically monitoring for requests involving unexpected numeric IDs.
  • Review user permissions and scope restrictions to ensure that only authorized accounts have access to sensitive email management functions.
]]>highadvisory