CVE-2026-38532 Details
Description
A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request.
A Broken Object-Level Authorization (BOLA) vulnerability has been identified in Webkul Krayin CRM version 2.2.x. The issue resides in the PersonController.php file, specifically within the contact management endpoint. This vulnerability allows authenticated attackers to arbitrarily read, modify, and permanently delete contacts owned by other users. Exploitation involves sending crafted GET, PUT, or DELETE requests with manipulated person IDs.
Implement object-level authorization checks in the PersonController to ensure that users can only access contacts they own. This can be done by verifying the person ID against the authenticated user's ID or by using Laravel Policy classes to enforce ownership. Additionally, audit logging can be introduced to track access attempts to contacts owned by other users.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/krayin/laravel-crm | [email protected] | Product |
| https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38532 | [email protected] | ExploitMitigationThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| webkul krayin crm | 2.2.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 14, 2026 | CVE Modified | CISA-ADP |
| Apr 14, 2026 | New CVE Received | [email protected] |