CVE-2026-125374 · Package
NO FIX YET · SEE WHAT TO DO
Krayin CRM before 2.2.8 skips a data-scope check in the Lead tag attach and detach actions. A logged-in user restricted to their own or their group's leads can add or remove tags on leads owned by other users.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Krayin CRM before 2.2.8 where some users have restricted data scope (individual or group). Installations where every user can see all leads are less exposed to the cross-scope tag change, though the sources do not say that explicitly.
Not affected if all-users-unrestricted-scope, krayin-crm-2.2.8-or-later
Who cares krayin-crm, laravel, php, self-hosted
composer.lock or the running admin footer; versions below 2.2.8 are exposed.2.2.8 or later.Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.