Krayin laravel-crm acl.php access control

published 2026-09-27 42 d ago modified 2026-09-28 41 d ago also EUVD-2026-88047

cvss: 6.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits: 0; none known

A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been published and may be used. Upgrading to version 2.2.6 is sufficient to fix this issue. This patch is called a399404a388d8ad2700a01349d0d98069c8e85a4. The affected component should be upgraded.

Patch / fix

fixed in 1 links 3

Krayin laravel-crm 2.2.6

github.com/krayin/laravel-crm@a399404 commit
github.com/krayin/laravel-crm#2626 pull request
github.com/krayin/laravel-crm/releases/tag/v2.2.6 release

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 41 d ago (2026-09-28)

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/carlosalbertotuma/advisory/blob/main/advisory-05-Missing-Function-Level%20Authorization.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA	3.0	6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
CNA	4.0	2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

Krayin laravel-crm

Classification

Weakness

CWE-284 Improper Access Control
CWE-266 Incorrect Privilege Assignment

References

github.com /krayin/laravel-crm/pull/2626
issue-tracking, patch
github.com /krayin/laravel-crm/commit/a399404a388d8ad2700a01349d0d98069c8e85a4
patch
github.com /krayin/laravel-crm/releases/tag/v2.2.6
patch
github.com /carlosalbertotuma/advisory/blob/main/advisory-05-Missing-Function-Level%20Authorization.md
exploit
vuldb.com /vuln/410813
vdb-entry
vuldb.com /vuln/410813/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-100883
third-party-advisory
vuldb.com /submit/916128
third-party-advisory
github.com /krayin/laravel-crm/issues/2623
issue-tracking
github.com /krayin/laravel-crm/
product

Sources

CVE List CVE-2026-100883
NVD CVE-2026-100883

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary