CVE-2026-38529 Details
Description
A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.
A Broken Object-Level Authorization (BOLA) vulnerability has been identified in Webkul Krayin CRM version 2.2.x. The issue resides in the UserController.php file, specifically within the /admin/settings/users/edit/{id} endpoint. This vulnerability allows authenticated attackers to reset the passwords of any non-admin users, leading to full account takeover. The exploitation involves sending a crafted PUT request that bypasses authorization checks, enabling attackers to manipulate user credentials without permission.
To address this vulnerability, implement proper object-level authorization checks to ensure that users can only modify their own accounts or those of administrators. Additionally, require current password verification when users change their passwords, and log all password change activities.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/krayin/laravel-crm | [email protected] | Product |
| https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38529 | [email protected] | ExploitMitigationThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | CISA-ADP |
| CWE-639 | Authorization Bypass Through User-Controlled Key | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| webkul krayin crm | 2.2.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 14, 2026 | CVE Modified | CISA-ADP |
| Apr 14, 2026 | New CVE Received | [email protected] |