CVE-2026-111349

Received Received - Intake

Unauthenticated Customer Record Creation in Craftplan

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111349

Affected Vendors & Products

Vendor	Product	Version / Range
puemos	Craftplan	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Craftplan through 0.7.5 has a missing authorization vulnerability in the CRM Customer resource. This allows unauthenticated attackers to create fake customer records by sending requests to POST /api/json/customers or using the create_customer mutation via JSON:API and GraphQL. Attackers can insert arbitrary names, contact details, and addresses into the operator's CRM system without any authentication.

Detection Guidance

Check for unauthorized customer records in your CRM by reviewing POST requests to /api/json/customers or GraphQL create_customer mutations. Monitor for unexpected JSON:API or GraphQL traffic to these endpoints.

Impact Analysis

This vulnerability could allow attackers to inject false customer data into your CRM system. This may lead to data corruption, misleading records, or potential misuse of your system for fraudulent activities. It could also disrupt legitimate business operations by flooding the system with fake entries.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA. It allows unauthorized data insertion, which may violate integrity and access control requirements. Organizations could face legal penalties, reputational damage, and loss of customer trust due to compromised data integrity.

Mitigation Strategies

Immediately restrict access to POST /api/json/customers and the create_customer GraphQL mutation. Implement authentication and authorization checks for these endpoints. Update Craftplan to the latest version if available.

Hi! I’m here to help you understand CVE-2026-111349. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70