# CVE-2026-100883: Krayin laravel-crm improper access control in ACL configuration

Source: https://junglewise.ai/threats/cve-2026-100883-a-flaw-has-been-found-in-krayin-laravel-crm-up-to-2-2-5-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-100883 · Severity: medium · CVSS 6.3 · Published 2026-09-27

Krayin laravel-crm is an open-source CRM application for managing customers, leads, and sales. A flaw in the access control configuration allows attackers to bypass authorization checks and access restricted functionality remotely. An attacker can escalate privileges and perform unauthorized actions within the CRM system without proper authentication.

Technologies: [Krayin Laravel-CRM](https://junglewise.ai/threats/technologies/laravel-crm). Vendors: [Krayin](https://junglewise.ai/threats/vendors/krayin).

## Quick answers

**Is CVE-2026-100883 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100883 being exploited in the wild.

**How severe is CVE-2026-100883?** Medium severity, with a CVSS score of 6.3, published 27 September 2026.

**Which products and versions are affected?** Krayin Laravel-CRM up to 2.2.5.

**Is there a fix for CVE-2026-100883?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100883 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100883?** Check whether you run Krayin Laravel-CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper access control flaw in the packages/Webkul/Admin/src/Config/acl.php configuration file affecting function-level authorization. The issue can be exploited remotely through manipulation of the affected configuration element, allowing unauthorized access to admin functions. A patch is available in version 2.2.6 (commit a399404a388d8ad2700a01349d0d98069c8e85a4).

## Affected products

- Krayin laravel-crm up to 2.2.5

## Timeline

- 2026-09-27: disclosed

## References

- [https://github.com/carlosalbertotuma/advisory/blob/main/advisory-05-Missing-Function-Level%20Authorization.md](https://github.com/carlosalbertotuma/advisory/blob/main/advisory-05-Missing-Function-Level%20Authorization.md)
- [https://github.com/krayin/laravel-crm/](https://github.com/krayin/laravel-crm/)

## Related threats

- [Krayin laravel-crm authentication bypass in installer](https://junglewise.ai/threats/cve-2026-100885-a-vulnerability-was-found-in-krayin-laravel-crm-up-to-2-2-4-this)
- [Krayin laravel-crm insecure direct object reference in attachment download](https://junglewise.ai/threats/cve-2026-100884-a-vulnerability-has-been-found-in-krayin-laravel-crm-up-to-2-2-5)
- [Krayin Laravel-CRM privilege escalation in user management](https://junglewise.ai/threats/cve-2026-97895-a-vulnerability-was-determined-in-krayin-laravel-crm-up-to-2-2-5)