{"id":"CVE-2026-112286","kind":"vulnerability","aliases":["CVE-2026-112286"],"related":[],"title":"Krayin CRM: scope-restricted users can read other users' quotes","description":"Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.","summary":"Krayin CRM before 2.2.7 fails to enforce per-user data scope checks in QuoteController. An authenticated user with a restricted scope can query the quotes search and lead-products endpoints and read quote addresses, totals, contact details and product pricing belonging to other users or leads.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["krayin-crm","laravel","package","php","self-hosted"],"not_affected_if":["all-users-full-scope","patched-2.2.7-or-later","single-user"],"how_to_check":"- Check the installed Krayin CRM version in composer.json or the release page; versions below `2.2.7` are affected\n- Review whether restricted-scope user roles exist in the deployment, since those are the accounts that can reach the flaw","fix":"- Upgrade Krayin CRM to `2.2.7` or later\n- Until upgraded, restrict quote and lead-product endpoint access to trusted roles only","status":"open","published_at":"2026-10-19T14:17:06+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:34:55+00:00","updated_at":"2026-10-25T03:34:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:34:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Krayin CRM to `2.2.7` or later\n- Until upgraded, restrict quote and lead-product endpoint access to trusted roles only","reach":"internet","title":"Krayin CRM: scope-restricted users can read other users' quotes","impact":"medium","summary":"Krayin CRM before 2.2.7 fails to enforce per-user data scope checks in QuoteController. An authenticated user with a restricted scope can query the quotes search and lead-products endpoints and read quote addresses, totals, contact details and product pricing belonging to other users or leads.","category":"package","nicknames":[],"who_cares":["krayin-crm","self-hosted","php","laravel"],"confidence":0.7,"needs_auth":"yes","worst_case":"Scope-restricted users read quote totals, contacts and pricing of others","analyst_note":"","how_to_check":"- Check the installed Krayin CRM version in composer.json or the release page; versions below `2.2.7` are affected\n- Review whether restricted-scope user roles exist in the deployment, since those are the accounts that can reach the flaw","needs_analyst":false,"not_affected_if":["single-user","all-users-full-scope","patched-2.2.7-or-later"],"who_is_affected":"Teams running Krayin CRM before 2.2.7 with multiple users or roles that have per-user data scopes. Single-user installs or installs where every account can see all quotes are less exposed, because the flaw only matters when scope is supposed to limit what an account sees.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000613,"input_tokens":3346,"output_tokens":557,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112286':14A,17A '-2026':13A,16A '2.2.7':30B,78C 'address':62B,122C 'allow':87C 'attack':108C 'authent':43B,91C 'belong':69B,129C 'bypass':99C 'check':39B,105C 'contact':64B,124C 'contain':79C 'crm':2A,20B,28B,76C 'cve':12A,15A 'data':37B,103C 'detail':65B,125C 'direct':82C 'endpoint':58B,118C 'enforc':33B 'fail':31B 'host':26B 'insecur':81C 'krayin':1A,19B,27B,75C 'krayin-crm':18B 'laravel':21B 'lead':56B,74B,116C,134C 'lead-product':55B,115C 'object':83C 'packag':22B 'per':35B,101C 'per-us':34B,100C 'php':23B 'price':68B,128C 'product':57B,67B,117C,127C 'queri':50B,110C 'quot':11A,52B,61B,97C,112C,121C 'quotecontrol':41B,107C 'read':8A,60B,94C 'refer':84C 'restrict':5A,47B,90C 'retriev':120C 'scope':4A,38B,48B,89C,104C 'scope-restrict':3A,88C 'search':53B,113C 'self':25B 'self-host':24B 'total':63B,123C 'user':6A,10A,36B,44B,72B,92C,96C,102C,132C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Teams running Krayin CRM before 2.2.7 with multiple users or roles that have per-user data scopes. Single-user installs or installs where every account can see all quotes are less exposed, because the flaw only matters when scope is supposed to limit what an account sees.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112286","severity":null,"published_at":"2026-10-19T14:17:06+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}