Is CVE-2026-38530 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-38530 being exploited in the wild.

How severe is CVE-2026-38530?

High severity, with a CVSS score of 8.1, published 14 April 2026.

Which products and versions are affected?

krayin/laravel-crm (Packagist) <= 2.2.0, ECOSYSTEM:introduced=0,last_affected=2.2.0; Webkul Krayin CRM <= 2.2.0.

Is there a fix for CVE-2026-38530?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-38530 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-38530?

Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38530: Webkul Krayin CRM BOLA in LeadController

Q: Is there a fix for CVE-2026-38530?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-38530 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-38530?

Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38530 · Severity: high · CVSS 8.1 · Published 2026-04-14

Webkul Krayin CRM, a customer relationship management platform, contains a security flaw in how it handles lead records. An authorized user of the system can view, modify, or permanently delete sales leads belonging to other users by simply changing the ID number in their browser's address bar. This could lead to the theft of sensitive customer data, loss of sales records, or unauthorized changes to deal statuses.

Technologies: krayin/laravel-crm (Packagist), Webkul Krayin CRM. Vendors: Packagist, Webkul.

Quick answers

Is CVE-2026-38530 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-38530 being exploited in the wild.
How severe is CVE-2026-38530?: High severity, with a CVSS score of 8.1, published 14 April 2026.
Which products and versions are affected?: krayin/laravel-crm (Packagist) <= 2.2.0, ECOSYSTEM:introduced=0,last_affected=2.2.0; Webkul Krayin CRM <= 2.2.0.
Is there a fix for CVE-2026-38530?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-38530 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-38530?: Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Broken Object-Level Authorization (BOLA) vulnerability, also known as Insecure Direct Object Reference (IDOR), exists in the LeadController.php of Webkul Krayin CRM v2.2.x. The application fails to perform ownership validation when processing requests for lead objects via the {id} parameter in GET, PUT, and DELETE requests. An authenticated attacker with low privileges can manipulate these IDs to bypass authorization and perform unauthorized CRUD operations on leads owned by other users. The root cause is the lack of a check to ensure the lead's user_id matches the authenticated user's ID or granted permissions. As of the advisory date, a formal patch version has not been confirmed.

Affected products

Webkul Krayin CRM (laravel-crm) <= 2.2.0

Identifiers

CVE-2026-38530
GHSA-rm5f-3c25-p4cw

Timeline

2026-04-14: advisory: GitHub Advisory published
2026-04-14: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.