Description
A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been published and may be used. Upgrading to version 2.2.6 is sufficient to fix this issue. This patch is called a399404a388d8ad2700a01349d0d98069c8e85a4. The affected component should be upgraded.
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Confidentiality (Vulnerable System)
Low
Integrity (Vulnerable System)
Low
Availability (Vulnerable System)
Low
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
E
Physical
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
E
Physical
RL
O
RC
Changed
Affected products
References
- MISChttps://vuldb.com/vuln/410813
- MISChttps://vuldb.com/vuln/410813/cti
- MISChttps://vuldb.com/cve/CVE-2026-100883
- MISChttps://vuldb.com/submit/916128
- MISChttps://github.com/krayin/laravel-crm/issues/2623
- PATCHhttps://github.com/krayin/laravel-crm/pull/2626
- VENDOR_ADVISORYhttps://github.com/carlosalbertotuma/advisory/blob/main/advisory-05-Missing-Function-Level%20Authorization.md
- PATCHhttps://github.com/krayin/laravel-crm/commit/a399404a388d8ad2700a01349d0d98069c8e85a4
- PATCHhttps://github.com/krayin/laravel-crm/releases/tag/v2.2.6
- MISChttps://github.com/krayin/laravel-crm/
Updated 21m ago · 8 sources