CyberRota Analysis
AI-GeneratedKrayin CRM versions up to 2.2.3 are vulnerable due to an insecure direct object reference in multiple controllers, allowing authenticated users to manipulate records owned by others without proper validation. This flaw can lead to unauthorized editing, updating, or deletion of sensitive CRM data, potentially compromising data integrity and user trust. Organizations using Krayin CRM should prioritize patching this vulnerability to safeguard against potential data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, update, and destroy methods.