CVE-2026-111349 Details
Description
Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.
A missing authorization vulnerability has been identified in Craftplan versions through 0.7.5, specifically within the CRM Customer resource. This vulnerability allows unauthenticated attackers to create and update customer records through JSON:API and GraphQL endpoints. Attackers can send anonymous requests to POST /api/json/customers or use the create_customer mutation to insert chosen names, contact details, and addresses into the CRM. The issue arises because the authorization policy for creating and updating customers allows all actors, including those without authentication, to bypass restrictions and manipulate customer data.
Craftplan should be updated to version 0.7.6 or later, where this vulnerability has been addressed. In the meantime, users can manually review and monitor customer records for any unauthorized changes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieuPenguinnn/craftplan-customer-public-write | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/puemos/craftplan | [email protected] | ProductSource CodeVendor |
| https://github.com/puemos/craftplan/blob/v0.7.5/lib/craftplan/accounts/checks/api_scope_check.ex#L33-L40 | [email protected] | Source CodeVendor |
| https://github.com/puemos/craftplan/blob/v0.7.5/lib/craftplan/crm/customer.ex#L91-L94 | [email protected] | Source CodeVendor |
| https://hackmd.io/@hieuPenguinnn/craftplan-customer-public-write | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/craftplan-through-0.7.5-missing-authorization-via-crm-customer-json-api-and-graphql | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| puemos Craftplan | <= 0.7.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |