# CVE-2026-97895: Krayin Laravel-CRM privilege escalation in user management

Source: https://junglewise.ai/threats/cve-2026-97895-a-vulnerability-was-determined-in-krayin-laravel-crm-up-to-2-2-5  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-97895 · Severity: medium · CVSS 6.3 · Published 2026-09-25

Krayin Laravel-CRM is an open-source customer relationship management platform. An attacker can escalate their privileges by manipulating the role_id parameter in the user management function, potentially gaining unauthorized administrative access without requiring special authentication or interaction.

Technologies: [Krayin Laravel-CRM](https://junglewise.ai/threats/technologies/laravel-crm). Vendors: [Krayin](https://junglewise.ai/threats/vendors/krayin).

## Quick answers

**Is CVE-2026-97895 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97895 being exploited in the wild.

**How severe is CVE-2026-97895?** Medium severity, with a CVSS score of 6.3, published 25 September 2026.

**Which products and versions are affected?** Krayin Laravel-CRM up to 2.2.5.

**Is there a fix for CVE-2026-97895?** A patch was published on 2026-09-25: Version 2.2.6 released with patch 5469d70336fbb25e8e513683e82b32982ce8aa82 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97895 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-97895?** Check whether you run Krayin Laravel-CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The UserController in the user management component fails to properly validate and restrict role assignment, allowing an unauthenticated or low-privileged attacker to manipulate the role_id argument during user creation or update operations. This improper authorization vulnerability (CWE-269/CWE-285) can be exploited remotely via HTTP requests. The vulnerability is fixed in version 2.2.6.

## Affected products

- Krayin Laravel-CRM up to 2.2.5

## Timeline

- 2026-09-25: disclosed
- 2026-09-25: patched: Version 2.2.6 released with patch 5469d70336fbb25e8e513683e82b32982ce8aa82

## References

- [https://github.com/carlosalbertotuma/advisory/blob/main/advisory-01-privesc.md](https://github.com/carlosalbertotuma/advisory/blob/main/advisory-01-privesc.md)
- [https://github.com/krayin/laravel-crm/](https://github.com/krayin/laravel-crm/)

## Related threats

- [Krayin laravel-crm authentication bypass in installer](https://junglewise.ai/threats/cve-2026-100885-a-vulnerability-was-found-in-krayin-laravel-crm-up-to-2-2-4-this)
- [Krayin laravel-crm insecure direct object reference in attachment download](https://junglewise.ai/threats/cve-2026-100884-a-vulnerability-has-been-found-in-krayin-laravel-crm-up-to-2-2-5)
- [Krayin laravel-crm improper access control in ACL configuration](https://junglewise.ai/threats/cve-2026-100883-a-flaw-has-been-found-in-krayin-laravel-crm-up-to-2-2-5-the)