Live › vulnerability › CVE-2026-112286
Go to dashboardKrayin CRM before 2.2.7 fails to enforce per-user data scope checks in QuoteController. An authenticated user with a restricted scope can query the quotes search and lead-products endpoints and read quote addresses, totals, contact details and product pricing belonging to other users or leads.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Krayin CRM before 2.2.7 with multiple users or roles that have per-user data scopes. Single-user installs or installs where every account can see all quotes are less exposed, because the flaw only matters when scope is supposed to limit what an account sees.
No product ranges from the sources yet.
2.2.7 are affected2.2.7 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.
This page as .md · .json · in your agent: get_signal("CVE-2026-112286")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.