CVE-2026-100885: Krayin Laravel CRM Auth Bypass Vulnerability

CVE-2026-100885 Overview

CVE-2026-100885 is an authorization bypass vulnerability in Krayin laravel-crm versions up to and including 2.2.4. The flaw resides in the CanInstall middleware located at packages/Webkul/Installer/src/Http/Middleware/CanInstall.php, which guards the admin-config-setup API endpoint. An unauthenticated remote attacker can reach installer functionality that should only be accessible before initial deployment. The vulnerability is tracked under [CWE-285: Improper Authorization] and a public exploit exists. Krayin addressed the issue in version 2.2.5 via commit 89f2916b6a46ff91bd1999ce38158fa0de8b9490.

Critical Impact
An unauthenticated attacker reaching a reachable Krayin CRM instance can bypass installer authorization checks and potentially take over the administrative configuration of the application.

Affected Products

Krayin laravel-crm versions up to and including 2.2.4
Component: admin-config-setup API endpoint
File: packages/Webkul/Installer/src/Http/Middleware/CanInstall.php

Discovery Timeline

2026-09-27 - CVE-2026-100885 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100885

Vulnerability Analysis

The vulnerability sits in the installer middleware responsible for restricting access to initial-setup endpoints. The CanInstall middleware fails to properly determine when installation has already completed, allowing requests to reach handlers that configure the administrator account and application settings. Because the installer endpoint accepts unauthenticated input, an attacker can invoke setup logic on a running production deployment. The upstream advisory describes the issue as an unauthenticated installer bypass that leads to administrative takeover.

Root Cause

The root cause is improper authorization enforcement [CWE-285] in the CanInstall middleware. The guard does not reliably reject requests to the admin-config-setup API endpoint once the application has been installed. Related handlers in the mail and email modules also lacked input constraints, which the maintainers hardened in the same security patch.

Attack Vector

Exploitation requires network access to the vulnerable application and no authentication or user interaction. A remote attacker sends a crafted HTTP request to the installer-controlled admin-config-setup endpoint. If the middleware does not block the request, the attacker can drive the installer flow to reset or create administrator credentials.

php

// Hardened validation added in packages/Webkul/Admin/src/Http/Controllers/Mail/EmailController.php
'reply_to'      => 'required|array|min:1',
'reply_to.*'    => 'email',
'reply'         => 'required',
'attachments'   => 'sometimes|array',
'attachments.*' => 'file|max:20480',

// Source: https://github.com/krayin/laravel-crm/commit/89f2916b6a46ff91bd1999ce38158fa0de8b9490

php

// Attachment repository wiring added in packages/Webkul/Email/src/Mails/Email.php
use Illuminate\Mail\Mailable;
use Illuminate\Queue\SerializesModels;
use Symfony\Component\Mime\Email as MimeEmail;
use Webkul\Email\Repositories\AttachmentRepository;

class Email extends Mailable
{
// Source: https://github.com/krayin/laravel-crm/commit/89f2916b6a46ff91bd1999ce38158fa0de8b9490

Detection Methods for CVE-2026-100885

Indicators of Compromise

Unauthenticated HTTP requests to the admin-config-setup API endpoint on a production Krayin CRM instance.
Unexpected modifications to the administrator account, including new admin users or password resets without a corresponding support ticket.
Access log entries referencing installer routes after the initial deployment date.

Detection Strategies

Review web server access logs for POST requests to installer paths originating from external IP addresses.
Alert on changes to administrator accounts and application configuration tables when they occur outside expected maintenance windows.
Compare the deployed version of packages/Webkul/Installer/src/Http/Middleware/CanInstall.php against the patched version from commit 89f2916b6a46ff91bd1999ce38158fa0de8b9490.

Monitoring Recommendations

Forward application and web server logs to a centralized analytics platform and build detections for installer-related URIs.
Monitor authentication events for sudden privilege elevations or admin account creations.
Track outbound connections from the CRM host that could indicate post-compromise data exfiltration.

How to Mitigate CVE-2026-100885

Immediate Actions Required

Upgrade Krayin laravel-crm to version 2.2.5 or later, which contains the authorization fix.
Audit administrator accounts and reset credentials for any suspicious or unrecognized users.
Restrict external network access to the CRM administrative interface until the patch is applied.

Patch Information

The vendor fix is tracked in GitHub Pull Request #2614 and applied in commit 89f2916b6a46ff91bd1999ce38158fa0de8b9490. The patched release is available as Krayin laravel-crm v2.2.5. Full technical details are documented in the GitHub Security Advisory and tracked at VulDB CVE-2026-100885.

Workarounds

Block access to installer routes at the reverse proxy or web application firewall layer when the application is in production.
Enforce IP allow-lists for the CRM administrative interface so that only trusted operator networks can reach setup endpoints.
Remove or rename the installer package directory after deployment is complete, where operationally feasible.

bash

# Example Nginx snippet blocking installer and admin-config-setup paths from external networks
location ~* ^/(installer|admin-config-setup) {
    allow 10.0.0.0/8;
    deny  all;
    try_files $uri $uri/ /index.php?$query_string;
}