CVE-2026-41452

CVE-2026-41452 is a missing authentication vulnerability found in Krayin CRM version 2.2.4. This flaw resides within the installer middleware, allowing unauthenticated remote attackers to overwrite the primary administrator account. Attackers can exploit this by sending a specially crafted HTTP POST request that includes the `X-Requested-With: XMLHttpRequest` header. This bypasses the `CanInstall` middleware redirect check, enabling them to supply arbitrary name, email, and password values to the `admin-config-setup` endpoint. This endpoint then performs an unauthenticated `updateOrInsert` operation targeting the hardcoded administrator user ID, effectively granting the attacker full administrative access to the CRM.