Webkul Krayin CRM hat Broken Object-Level Authorization (BOLA) in der /Settings/UserController.php

The impact of CVE-2026-38529 is significant, enabling an attacker with valid credentials to compromise any user account within the Krayin CRM system. By exploiting this BOLA vulnerability, an attacker can craft a malicious HTTP request to reset a target user's password without proper authorization checks. This effectively grants the attacker full control over the compromised account, including access to sensitive customer data, configuration settings, and potentially other connected systems. The blast radius extends to all users of the affected Krayin CRM instances, and the ease of exploitation makes it a high-priority concern.

1. Reserviert2026-04-06
2. Veröffentlicht2026-04-14
3. Geändert2026-04-15
4. EPSS aktualisiert2026-04-22

The primary mitigation for CVE-2026-38529 is to immediately upgrade Krayin CRM to version 2.3.0 or later, which includes the necessary authorization checks to prevent password resets without proper validation. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting access to the /Settings/UserController.php endpoint to only authorized administrators. Review user access controls and enforce strong password policies. Monitor logs for suspicious password reset activity. After upgrading, confirm the fix by attempting a password reset with a non-administrator account and verifying that the action is denied.

Zuletzt aktualisiert

2.2.3kürzlich