---
id: "CVE-2026-112287"
kind: "vulnerability"
aliases: ["CVE-2026-112287"]
title: "Krayin CRM: scoped users can edit or delete other users' emails"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["email", "krayin-crm", "laravel", "package", "php", "self-hosted"]
not_affected_if: ["single-user-instance", "version-2.2.7-or-later"]
published_at: "2026-10-19T14:17:07+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:34:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112287", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Krayin CRM: scoped users can edit or delete other users' emails

Krayin CRM before 2.2.7 has a missing object-level authorization check in its EmailController write actions. A signed-in user with limited scope can supply another user's numeric email ID to update, resend, trash or permanently delete that email, and read its subject, body and linked lead and person data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Krayin CRM version in composer.json or the release tag; anything below `2.2.7` is affected.
- unknown for route-level checks: the sources do not name the exact endpoint paths beyond EmailController write actions.

## Fix

- Upgrade Krayin CRM to `2.2.7` or later.
- Until upgraded, restrict CRM user accounts to trusted staff, since any authenticated user with email scope can reach the flaw.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112287

## From the sources

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via is_draft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_