CVE-2026-125374

EUVD-2026-120537
Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 17.74%
Common Weakness Enumeration
References
https://github.com/krayin/laravel-crm
https://github.com/krayin/laravel-crm/blob/999b596d0f53cb11c9b029f733a1d67e01fccda6/packages/Webkul/Admin/src/Http/Controllers/Lead/TagController.php#L26-L55
https://github.com/krayin/laravel-crm/commit/3cfa2f763563723469dd1cb7ab53e51b269139bc
https://github.com/krayin/laravel-crm/commit/95e0dbc83a72933aeaf72190a0f570ea1ddcc452
https://github.com/krayin/laravel-crm/releases/tag/v2.2.8
https://www.vulncheck.com/advisories/krayin-crm-before-2.2.8-broken-object-level-authorization-via-lead-tag-attach-detach