CVE-2026-41452

Published Aug 3, 2026

Last updated 16 days ago

CVSS critical 9.3
Krayin CRM

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-41452 is a missing authentication vulnerability found in Krayin CRM version 2.2.4. This flaw resides within the installer middleware, allowing unauthenticated remote attackers to overwrite the primary administrator account. Attackers can exploit this by sending a specially crafted HTTP POST request that includes the `X-Requested-With: XMLHttpRequest` header. This bypasses the `CanInstall` middleware redirect check, enabling them to supply arbitrary name, email, and password values to the `admin-config-setup` endpoint. This endpoint then performs an unauthenticated `updateOrInsert` operation targeting the hardcoded administrator user ID, effectively granting the attacker full administrative access to the CRM.

Description
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert targeting the hardcoded administrator user ID, enabling full administrative access to all CRM data.
Source
disclosure@vulncheck.com
NVD status
Received

Risk scores

CVSS 4.0

Type
Secondary
Base score
9.3
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
CRITICAL

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

disclosure@vulncheck.com
CWE-306

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

11

  1. 🚨 PoC RELEASED: Public exploit code is available for CVE-2026-41452, a critical authentication flaw in Krayin CRM 2.2.4. The vulnerability allows unauthenticated attackers to overwrite the primary administrator account with attacker-controlled credentials, resulting in full

    @ThreatWire_

    16 Aug 2026

    6730 Impressions

    9 Retweets

    32 Likes

    15 Bookmarks

    0 Replies

    0 Quotes

References

Sources include official advisories and independent security research.