CVE-2026-100885

Received Received - Intake

Authorization Bypass in Krayin Laravel-CRM

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulDB

Description

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 2.2.5 mitigates this issue. The patch is identified as 89f2916b6a46ff91bd1999ce38158fa0de8b9490. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-27

Last Modified

2026-09-27

Generated

2026-09-28

AI Q&A

2026-09-28

EPSS Evaluated

N/A

NVD

CVE-2026-100885

Affected Vendors & Products

Vendor	Product	Version / Range
krayin	laravel-crm	to 2.2.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in Krayin laravel-crm versions up to 2.2.4. It affects the admin-config-setup API endpoint via the CanInstall.php middleware. An attacker can remotely exploit this to bypass authorization checks without authentication.

Detection Guidance

Check if your Krayin laravel-crm version is below 2.2.5. Inspect the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php for unauthorized access attempts or unusual API endpoint interactions.

Impact Analysis

An attacker could gain unauthorized access to administrative functions, potentially allowing them to modify configurations, access sensitive data, or disrupt system operations. Public exploits exist, increasing the risk of real-world attacks.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's security rules. Compliance may be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Upgrade Krayin laravel-crm to version 2.2.5 or later. Apply the patch identified as 89f2916b6a46ff91bd1999ce38158fa0de8b9490 if available. Review and restrict access to the admin-config-setup API endpoint.

Hi! I’m here to help you understand CVE-2026-100885. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70