Live › vulnerability › CVE-2026-112287
Go to dashboardKrayin CRM before 2.2.7 has a missing object-level authorization check in its EmailController write actions. A signed-in user with limited scope can supply another user's numeric email ID to update, resend, trash or permanently delete that email, and read its subject, body and linked lead and person data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted Krayin CRM before 2.2.7 where more than one user has authenticated access with a restricted email scope. The exposure is about one user reaching another user's mail, so single-user installations with no scoped accounts are much less exposed. The sources do not say whether managed or hosted Krayin instances are patched by the vendor.
No product ranges from the sources yet.
2.2.7 is affected.2.2.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via is_draft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.
This page as .md · .json · in your agent: get_signal("CVE-2026-112287")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.