CVE-2026-61460: Krayin CRM Auth Bypass Vulnerability

CVE-2026-61460 Overview

CVE-2026-61460 is an Insecure Direct Object Reference (IDOR) vulnerability affecting Krayin CRM through version 2.2.3. The flaw resides in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController. These controllers fail to enforce record-level ownership checks in their edit, update, and destroy methods. Authenticated users can therefore modify, reassign, or delete CRM records owned by other users. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated Krayin CRM user can tamper with or destroy leads, persons, organizations, quotes, and activities belonging to other tenants of the CRM by manipulating record identifiers in HTTP requests.

Affected Products

Krayin CRM versions up to and including 2.2.3
Deployments using laravel-crm from the upstream Krayin repository
Self-hosted Krayin instances exposing authenticated CRM routes

Discovery Timeline

2026-07-10 - CVE-2026-61460 published to the National Vulnerability Database
2026-07-10 - CVE-2026-61460 record last modified in NVD

Technical Details for CVE-2026-61460

Vulnerability Analysis

Krayin CRM exposes standard Laravel resource routes for leads, persons, organizations, quotes, and activities. Each controller accepts a numeric record identifier through the URL. The affected controllers dispatch directly to repository methods without verifying that the authenticated user owns the target record. As a result, an attacker with a valid low-privilege session can substitute another user's identifier and invoke the edit, update, or destroy action. The vulnerability allows unauthorized read of edit forms, arbitrary modification of record fields including the owner assignment, and full deletion of records.

Root Cause

The root cause is missing object-level authorization. The controllers rely on route-level authentication and role checks but never compare the record's owner with the current session user. Laravel's policy or gate mechanism is not invoked before repository writes, so any authenticated user can address any record ID.

Attack Vector

Exploitation requires only network access to the CRM and valid low-privilege credentials. An attacker enumerates or guesses record IDs, then issues HTTP requests to routes such as /leads/edit/{id}, /leads/update/{id}, /persons/{id} with a DELETE, or the equivalents for quotes, organizations, and activities. The request body may include an updated user_id or person_id field to reassign ownership of the record to the attacker.

No verified proof-of-concept code has been published. See the Krayin GitHub issue #2559, the remediation pull request #2567, and the VulnCheck advisory for technical details.

Detection Methods for CVE-2026-61460

Indicators of Compromise

Unexpected changes to the user_id, person_id, or organization_id fields of CRM records without a corresponding administrative action.
Deletion events on leads, quotes, or activities performed by accounts that do not own the record.
HTTP POST, PUT, or DELETE requests to /leads/, /persons/, /organizations/, /quotes/, or /activities/ endpoints referencing record IDs outside the user's assigned scope.

Detection Strategies

Compare the updated_by or session user in application logs against the historical owner of each modified record and alert on mismatches.
Baseline normal record-access patterns per user and flag accounts that touch a disproportionate number of records in a short window.
Inspect web server logs for sequential enumeration of numeric record identifiers against the affected controllers.

Monitoring Recommendations

Enable Laravel's built-in query and route logging for the affected controllers and ship logs to a centralized store.
Add database-level auditing on the leads, persons, organizations, quotes, and activities tables to record who mutated each row.
Alert on any HTTP 4xx/5xx spikes on CRM edit and delete routes, which often accompany ID enumeration attempts.

How to Mitigate CVE-2026-61460

Immediate Actions Required

Upgrade Krayin CRM to a version that includes the fix from pull request #2567 once released beyond 2.2.3.
Restrict CRM access to trusted networks or place the application behind a VPN until the patch is applied.
Review recent record modifications and ownership reassignments to identify potential abuse.

Patch Information

The upstream fix is tracked in Krayin pull request #2567, which adds ownership validation to the edit, update, and destroy methods of the affected controllers. Administrators should monitor the Krayin laravel-crm releases page and deploy the first tagged release that incorporates the merged patch.

Workarounds

Apply the controller changes from pull request #2567 manually to production instances by adding ownership checks that compare Auth::id() with the record's user_id before persistence.
Introduce a Laravel policy for each affected model and register it in AuthServiceProvider, then invoke $this->authorize('update', $record) inside each controller action.
Limit CRM accounts to the minimum privileges required and disable self-service registration to reduce the pool of authenticated attackers.

bash

# Configuration example: enforce ownership in a Laravel policy
php artisan make:policy LeadPolicy --model=Lead
# In app/Policies/LeadPolicy.php implement update() and delete():
#   return $user->id === $lead->user_id;
# Then in LeadController::update() and destroy(), call:
#   $this->authorize('update', $lead);
#   $this->authorize('delete', $lead);