PT-2026-57273 · Krayin · Laravel-Crm

George Chen · Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-61460

Mitre

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, update, and destroy methods.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-61460

Produtos afetados

Laravel-Crm

Referências · 4

• 🔥 https://github.com/krayin/laravel-crm/issues/2559 · Exploit
• https://github.com/krayin/laravel-crm/pull/2567 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-61460 · Nota de Segurança
• https://vulncheck.com/advisories/krayin-crm-insecure-direct-object-reference-via-controllers · Nota