Executive brief
Webkul Krayin CRM, a customer relationship management platform, contains a security flaw in its user management settings. An authenticated user can exploit this to reset the passwords of other users or deactivate their accounts without authorization. This could lead to a full takeover of user accounts, allowing unauthorized access to sensitive customer data, leads, and business activities.
Technical details
A Broken Object-Level Authorization (BOLA) / IDOR vulnerability exists in the /admin/settings/users/edit/{id} endpoint within Webkul Krayin CRM <= 2.2.0. The root cause is a logic error in the canEditAuthFields gate within UserController.php, which permits any non-admin user with 'users.edit' permissions to modify the authentication fields of any other non-admin user without verifying ownership. An attacker can send a crafted PUT request to the vulnerable endpoint to change a target user's password or 'activated' status. This allows for full account takeover of non-admin accounts or a denial-of-service by deactivating accounts. No patch was officially noted in the advisory, though mitigations include implementing strict ownership checks and requiring current password verification for credential changes.
Affected products
- Webkul Krayin CRM (laravel-crm) <= 2.2.0
Timeline
- 2026-04-14: disclosed
- 2026-04-14: advisory: GHSA-r8rp-5f55-5j9x published