6 matches found
EUVD-2026-120537
Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope...
CVE-2026-125374
Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope...
CVE-2026-125374: krayin laravel-crm: Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and…
Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope...
CVE-2026-125374 Krayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/Detach
Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope...
CVE-2026-125374
Krayin CRM versions prior to 2.2.8 are susceptible to a broken object level authorization vulnerability (CWE-639) within the Lead TagController attach and detach actions. The root cause is that these actions skip necessary data-scope checks , allowing authenticated users restricted to specific in...
PT-2026-141197
Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope...