High severity · published Jul 10, 2026
CVE-2026-61460
Krayin CRM Insecure Direct Object Reference via Controllers
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, update, and destroy methods.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
laravel-crm · krayin
through 2.2.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-61460
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-61460
github.com
https://github.com/krayin/laravel-crm/issues/2559
github.com
https://github.com/krayin/laravel-crm/pull/2567
www.vulncheck.com
https://www.vulncheck.com/advisories/krayin-crm-insecure-direct-object-reference-via-controllers
More from laravel-crm
9.8
CVE-2026-41452
Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup
8.8
CVE-2026-41453
Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter
8.2
CVE-2026-90944
Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
7.3
CVE-2026-100885
Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization
7.1
CVE-2026-112287
Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module