Is CVE-2026-38532 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-38532 being exploited in the wild.

How severe is CVE-2026-38532?

High severity, with a CVSS score of 8.1, published 14 April 2026.

Which products and versions are affected?

krayin/laravel-crm (Packagist) <= 2.2.0, ECOSYSTEM:introduced=0,last_affected=2.2.0; Webkul Krayin CRM <= 2.2.0.

Is there a fix for CVE-2026-38532?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-38532 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-38532?

Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38532: Webkul Krayin CRM BOLA in PersonController

Q: Is there a fix for CVE-2026-38532?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-38532 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-38532?

Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38532 · Severity: high · CVSS 8.1 · Published 2026-04-14

Webkul Krayin CRM, an open-source customer relationship management platform, contains a security flaw in how it handles contact records. An authorized user of the system can view, modify, or permanently delete contact information belonging to other users by simply changing the ID number in their web browser. This could lead to the exposure of sensitive customer data, loss of business records, and potential regulatory compliance issues.

Technologies: krayin/laravel-crm (Packagist), Webkul Krayin CRM. Vendors: Packagist, Webkul.

Quick answers

Is CVE-2026-38532 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-38532 being exploited in the wild.
How severe is CVE-2026-38532?: High severity, with a CVSS score of 8.1, published 14 April 2026.
Which products and versions are affected?: krayin/laravel-crm (Packagist) <= 2.2.0, ECOSYSTEM:introduced=0,last_affected=2.2.0; Webkul Krayin CRM <= 2.2.0.
Is there a fix for CVE-2026-38532?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-38532 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-38532?: Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Broken Object-Level Authorization (BOLA) vulnerability, also known as Insecure Direct Object Reference (IDOR), exists in Webkul Krayin CRM v2.2.x within the `PersonController.php` component. The application fails to perform ownership or permission checks when processing requests for contact/person objects via the `/admin/contacts/persons/` endpoints. An authenticated attacker with low-level privileges can manipulate the `{id}` parameter in GET, PUT, or DELETE requests to arbitrarily read, modify, or delete contact records owned by other users. This is a systemic issue where the backend does not verify if the `person->user_id` matches the authenticated user's ID. No patch was available at the time of disclosure.

Affected products

Webkul Krayin CRM (laravel-crm) <= 2.2.0

Identifiers

CVE-2026-38532
GHSA-2xx8-j85v-j7wh

Timeline

2026-04-14: advisory: NVD and GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.