CVE-2026-100885Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization
Updated under an hour ago ()
Does this affect you?
It affects Krayin laravel-crm. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 1.00%, higher than 62% of scored CVEs.
Do this next
Free account, 1 product
A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 2.2.5 mitigates this issue. The patch is identified as 89f2916b6a46ff91bd1999ce38158fa0de8b9490. Upgrading the affected component is recommended.
- CVSS
- 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
- Weakness (CWE)
- CWE-639, CWE-285
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 1.00% (percentile 62)
- Assigned by
- VulDB
- NVD analysis
- Deferred
- Record last updated
- Sep 30, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Krayin laravel-crm krayin:laravel-crm | 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5 not affected | CNA record |
References
- https://vuldb.com/vuln/410815vdb-entry
- https://vuldb.com/vuln/410815/ctisignature, permissions-required
- https://vuldb.com/cve/CVE-2026-100885third-party-advisory
- https://vuldb.com/submit/916597third-party-advisory
- https://github.com/carlosalbertotuma/advisory/blob/main/advisory-07-Unauthenticated-InstallerBypass.mdexploit
- https://github.com/krayin/laravel-crm/pull/2614issue-tracking, patch
- https://github.com/krayin/laravel-crm/commit/89f2916b6a46ff91bd1999ce38158fa0de8b9490patch
- https://github.com/krayin/laravel-crm/releases/tag/v2.2.5patch
- https://github.com/krayin/laravel-crm/product
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.