CVE-2026-90944: Krayin CRM Authentication Bypass Vulnerability

CVE-2026-90944 Overview

CVE-2026-90944 is an unauthenticated email injection vulnerability in Krayin CRM through version 2.2.6. The POST /admin/mail/inbound-parse endpoint is exposed without authentication, allowing remote attackers to inject arbitrary emails directly into the CRM inbox. Attackers can craft RFC 2822 messages with forged sender addresses and headers to insert emails with any subject or body content. Because the endpoint accepts thread identifiers, attackers can also inject messages as replies to existing conversation threads, enabling convincing social engineering against CRM users. The flaw is tracked as a Missing Authentication for Critical Function issue [CWE-306].

Critical Impact
Unauthenticated network attackers can forge inbound emails within Krayin CRM, poisoning conversation threads and enabling internal phishing or business logic abuse.

Affected Products

Krayin CRM versions through 2.2.6
Laravel-based CRM deployments using the Webkul Admin mail-routes.php package
Self-hosted Krayin installations exposing the admin interface to untrusted networks

Discovery Timeline

2026-09-14 - CVE-2026-90944 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90944

Vulnerability Analysis

The vulnerability resides in Krayin CRM's inbound email parsing route. The POST /admin/mail/inbound-parse endpoint is registered without any authentication middleware, meaning any unauthenticated client on the network can submit inbound email payloads. The application processes the submitted RFC 2822 message and stores it as a legitimate inbox entry attributed to the sender address specified by the attacker.

Because the endpoint trusts sender information and headers supplied in the request body, attackers can impersonate customers, executives, or third parties inside the CRM. Injected messages can also thread onto existing conversations, appearing as legitimate replies to prior correspondence. This undermines the integrity of communications stored in the CRM and can be used to trigger fraudulent workflows.

Root Cause

The root cause is missing authentication on a sensitive administrative route. The route defined in packages/Webkul/Admin/src/Routes/Admin/mail-routes.php for the inbound parse handler is not protected by the admin guard applied to other admin endpoints. Combined with the absence of sender verification such as SPF, DKIM, or DMARC checks on the parsed payload, this allows arbitrary content to be treated as an authentic inbound email.

Attack Vector

An attacker sends a crafted HTTP POST request to the exposed /admin/mail/inbound-parse endpoint over the network. The request body contains a forged RFC 2822 message specifying arbitrary From, To, Subject, In-Reply-To, and References headers along with attacker-controlled body content. No credentials, tokens, or user interaction are required. The injected message subsequently appears in the CRM inbox as if it originated from the spoofed sender, enabling internal phishing and thread hijacking against sales, support, or executive staff who rely on the CRM as a trusted communications record.

Refer to the VulnCheck Advisory on Krayin CRM and the corresponding GitHub Issue #2560 for additional technical detail.

Detection Methods for CVE-2026-90944

Indicators of Compromise

Unexpected HTTP POST requests to /admin/mail/inbound-parse originating from unauthenticated sources or unusual IP ranges.
CRM inbox entries with From addresses that do not correspond to legitimate mail gateway traffic or lack matching SMTP delivery records.
Injected replies appearing in existing threads without corresponding outbound emails or upstream mail server logs.
Sudden spikes in inbound-parse endpoint traffic that do not correlate with expected inbound email volume.

Detection Strategies

Enable verbose web server access logging for the Krayin admin path and alert on any request to inbound-parse that lacks an authenticated admin session cookie.
Reconcile CRM inbox entries against authoritative mail transport logs to identify emails that were injected via the HTTP endpoint rather than delivered through SMTP.
Deploy Web Application Firewall (WAF) rules that restrict the /admin/mail/inbound-parse route to known mail relay source addresses.

Monitoring Recommendations

Forward Krayin application and web server logs into a centralized analytics platform for correlation and long-term retention.
Monitor for anomalous CRM user activity such as replies to spoofed threads or workflow actions triggered by unverified sender addresses.
Track request patterns targeting Laravel admin routes to identify probing behavior consistent with unauthenticated endpoint discovery.

How to Mitigate CVE-2026-90944

Immediate Actions Required

Restrict network access to the /admin/mail/inbound-parse endpoint using firewall or reverse proxy rules, allowing only trusted mail relay hosts.
Audit the CRM inbox for suspicious messages received prior to remediation and validate the authenticity of recent conversation threads.
Rotate any credentials or approve any workflow decisions that may have been influenced by messages received during the exposure window.

Patch Information

No vendor patch is referenced in the current advisory data. Monitor the Krayin Laravel CRM Repository and GitHub Issue #2560 for an official fix. Once a release addressing the missing authentication on mail-routes.php is published, upgrade all Krayin CRM instances beyond version 2.2.6.

Workarounds

Add authentication middleware to the inbound-parse route by editing packages/Webkul/Admin/src/Routes/Admin/mail-routes.php and wrapping the route in the admin guard group.
Terminate inbound email ingestion at a dedicated mail gateway that performs SPF, DKIM, and DMARC validation before forwarding messages to the CRM.
Place the Krayin admin interface behind a VPN or IP allowlist so that unauthenticated internet clients cannot reach any /admin/* route.

bash

# Example nginx configuration restricting the inbound-parse endpoint
location = /admin/mail/inbound-parse {
    allow 10.20.30.40;   # trusted mail relay
    deny all;
    proxy_pass http://krayin_backend;
}