Is CVE-2026-38529 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-38529 being exploited in the wild.

How severe is CVE-2026-38529?

High severity, with a CVSS score of 8.8, published 14 April 2026.

Which products and versions are affected?

krayin/laravel-crm (Packagist) <= 2.2.0, ECOSYSTEM:introduced=0,last_affected=2.2.0; Webkul Krayin CRM <= 2.2.0.

Is there a fix for CVE-2026-38529?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-38529 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-38529?

Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38529: Webkul Krayin CRM BOLA in UserController password reset

Q: Is there a fix for CVE-2026-38529?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-38529 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-38529?

Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38529 · Severity: high · CVSS 8.8 · Published 2026-04-14

Webkul Krayin CRM, a customer relationship management platform, contains a security flaw in its user management settings. An authenticated user can exploit this to reset the passwords of other users or deactivate their accounts without authorization. This could lead to a full takeover of user accounts, allowing unauthorized access to sensitive customer data, leads, and business activities.

Technologies: krayin/laravel-crm (Packagist), Webkul Krayin CRM. Vendors: Packagist, Webkul.

Quick answers

Is CVE-2026-38529 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-38529 being exploited in the wild.
How severe is CVE-2026-38529?: High severity, with a CVSS score of 8.8, published 14 April 2026.
Which products and versions are affected?: krayin/laravel-crm (Packagist) <= 2.2.0, ECOSYSTEM:introduced=0,last_affected=2.2.0; Webkul Krayin CRM <= 2.2.0.
Is there a fix for CVE-2026-38529?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-38529 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-38529?: Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Broken Object-Level Authorization (BOLA) / IDOR vulnerability exists in the /admin/settings/users/edit/{id} endpoint within Webkul Krayin CRM <= 2.2.0. The root cause is a logic error in the canEditAuthFields gate within UserController.php, which permits any non-admin user with 'users.edit' permissions to modify the authentication fields of any other non-admin user without verifying ownership. An attacker can send a crafted PUT request to the vulnerable endpoint to change a target user's password or 'activated' status. This allows for full account takeover of non-admin accounts or a denial-of-service by deactivating accounts. No patch was officially noted in the advisory, though mitigations include implementing strict ownership checks and requiring current password verification for credential changes.

Affected products

Webkul Krayin CRM (laravel-crm) <= 2.2.0

Identifiers

CVE-2026-38529
GHSA-r8rp-5f55-5j9x

Timeline

2026-04-14: disclosed
2026-04-14: advisory: GHSA-r8rp-5f55-5j9x published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.