# CVE-2026-90944: Krayin CRM unauthenticated email injection via inbound-parse endpoint

Source: https://junglewise.ai/threats/cve-2026-90944-krayin-crm-unauthenticated-email-injection-via-inbound-parse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90944 · Severity: high · CVSS 8.2 · Published 2026-09-14

Krayin CRM is an open-source customer relationship management system for managing sales, leads, and customer interactions. The application's email inbound parser endpoint fails to require authentication, allowing attackers to inject arbitrary emails directly into the CRM inbox with forged sender information and headers. This could enable phishing attacks, fraud, or manipulation of customer communication records without any user action required.

## Quick answers

**Is CVE-2026-90944 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90944 being exploited in the wild.

**How severe is CVE-2026-90944?** High severity, with a CVSS score of 8.2, published 14 September 2026.

**Which products and versions are affected?** Krayin CRM through 2.2.6.

**Is there a fix for CVE-2026-90944?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90944 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-90944?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass affecting the POST /admin/mail/inbound-parse endpoint in Krayin CRM through version 2.2.6. The endpoint is explicitly excluded from CSRF token validation (as seen in bootstrap/app.php), and lacks authentication middleware, making it accessible to unauthenticated attackers. An attacker can send crafted RFC 2822 formatted email messages with forged sender addresses, subjects, and body content—including replies to existing conversation threads—directly into the CRM's inbox. The vulnerability requires no authentication, CAPTCHA, or user interaction beyond network reachability to the endpoint. Updates are needed to add proper authentication and authorization checks before processing inbound email messages.

## Affected products

- Krayin CRM through 2.2.6

## Timeline

- 2026-09-14: disclosed

## References

- [https://github.com/krayin/laravel-crm](https://github.com/krayin/laravel-crm)
- [https://github.com/krayin/laravel-crm/blob/v2.2.6/bootstrap/app.php](https://github.com/krayin/laravel-crm/blob/v2.2.6/bootstrap/app.php)