Executive brief
Webkul Krayin CRM, an open-source customer relationship management platform, contains a security flaw in how it handles contact records. An authorized user of the system can view, modify, or permanently delete contact information belonging to other users by simply changing the ID number in their web browser. This could lead to the exposure of sensitive customer data, loss of business records, and potential regulatory compliance issues.
Technical details
A Broken Object-Level Authorization (BOLA) vulnerability, also known as Insecure Direct Object Reference (IDOR), exists in Webkul Krayin CRM v2.2.x within the `PersonController.php` component. The application fails to perform ownership or permission checks when processing requests for contact/person objects via the `/admin/contacts/persons/` endpoints. An authenticated attacker with low-level privileges can manipulate the `{id}` parameter in GET, PUT, or DELETE requests to arbitrarily read, modify, or delete contact records owned by other users. This is a systemic issue where the backend does not verify if the `person->user_id` matches the authenticated user's ID. No patch was available at the time of disclosure.
Affected products
- Webkul Krayin CRM (laravel-crm) <= 2.2.0
Timeline
- 2026-04-14: advisory: NVD and GitHub Advisory published