CVE-2026-38530: Webkul Krayin CRM Arbitrary Lead Access Vulnerability
Summary
CVE-2026-38530: A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owne... Affects krayin/laravel-crm versions < 2.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Webkul Krayin CRM is a customer relationship management system built on the Laravel framework, designed to help businesses manage their leads, customers, and sales processes efficiently. It offers features such as lead tracking, customer management, and sales analytics. However, a critical vulnerability has been identified in version 2.2.x that compromises the security of lead data.
Vulnerability Detail
The vulnerability is a Broken Object-Level Authorization (BOLA) found in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x. This flaw allows authenticated attackers to manipulate requests to read, modify, or permanently delete leads that belong to other users. The issue arises from inadequate authorization checks, which can lead to unauthorized access and data breaches, potentially exposing sensitive customer information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the /Controllers/Lead/LeadController.php endpoint by implementing additional authorization checks in your application code to ensure that users can only access their own leads.
Conclusion
The Broken Object-Level Authorization vulnerability in Webkul Krayin CRM poses a significant risk to user data integrity and security. It is crucial for users of the affected version to update their systems promptly and consider implementing additional authorization checks as a temporary measure.
See every vulnerability recorded for krayin/laravel-crm →
FAQ
CVE-2026-38530 is a vulnerability in Webkul Krayin CRM that allows authenticated users to access and manipulate leads owned by other users due to broken authorization checks.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
The consequences include unauthorized access to sensitive lead information, potential data breaches, and loss of customer trust, which can significantly impact business operations.
Yes, a patch is available. You should update to a version higher than 2.2.0 to mitigate the vulnerability.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for krayin/laravel-crm.
