CVE-2026-97895

Received Received - Intake

Improper Privilege Management in Krayin Laravel-CRM

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulDB

Description

A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_id can lead to improper privilege management. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.6 is able to mitigate this issue. This patch is called 5469d70336fbb25e8e513683e82b32982ce8aa82. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-97895

EUVD

EUVD-2026-87260

Affected Vendors & Products

Vendor	Product	Version / Range
krayin	laravel-crm	to 2.2.5 (inc)
krayin	laravel-crm	2.2.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in krayin laravel-crm versions up to 2.2.5. It involves improper privilege management due to a manipulation of the role_id argument in the User Management component. The issue allows remote attackers to potentially escalate privileges or perform unauthorized actions.

Detection Guidance

To detect this vulnerability, check the version of krayin laravel-crm installed on your system. If it is version 2.2.5 or earlier, the system is vulnerable. Compare the installed version against the patched version 2.2.6.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to gain elevated privileges or perform actions they should not be able to. This might lead to data breaches, unauthorized access to sensitive information, or disruption of CRM operations.

Mitigation Strategies

Immediately upgrade krayin laravel-crm to version 2.2.6 or later. Apply the patch 5469d70336fbb25e8e513683e82b32982ce8aa82 if available. Ensure proper privilege management settings are configured after upgrade.

Hi! I’m here to help you understand CVE-2026-97895. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70