CVE-2026-111349 in Craftplan
Summary
by MITRE • 10/16/2026
Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
Craftplan versions through 0.7.5 are susceptible to a critical missing authorization vulnerability within its Customer resource module. This flaw stems from an insufficient access control mechanism that fails to verify user authentication or privilege levels before processing requests intended for customer data management. Specifically, the application does not enforce mandatory identity verification on endpoints responsible for creating new customer records. As a result, any actor with network connectivity to the service can interact with these resources without providing valid credentials or session tokens. This represents a fundamental breakdown in the principle of least privilege and proper authentication enforcement, allowing external entities to perform state-changing operations that should be restricted to authorized administrative users or authenticated customers.
The technical exploitation vector involves sending HTTP POST requests directly to the JSON:API endpoint located at /api/json/customers or utilizing GraphQL mutations such as create_customer. Because the server does not validate the presence of a valid authentication header or session cookie prior to executing these write operations, an unauthenticated attacker can inject arbitrary data into the system's database. The vulnerability allows for the insertion of fabricated customer records containing maliciously chosen names, contact details, and physical addresses. This capability effectively bypasses all intended security boundaries designed to protect sensitive business logic and personal identifiable information within the CRM subsystem.
The operational impact of this vulnerability is significant due to its potential to disrupt data integrity and facilitate further attacks. By injecting false customer entries, attackers can pollute the database with junk data, leading to confusion for support staff and inaccurate analytics reports. More critically, these fabricated records may be used as a foothold for subsequent social engineering campaigns or phishing attempts targeting other users of the platform who trust the CRM system's integrity. Additionally, if the application subsequently sends automated emails or communications to newly created customer addresses based on this data, it could inadvertently contribute to spam distribution or reputation damage for the organization hosting Craftplan. The ability to manipulate core business entities without authentication undermines the reliability and security posture of the entire application ecosystem.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to adequately verify the identity of users attempting to access protected resources. It also relates closely to CWE-862 Missing Authorization, since even if authentication were present, the specific resource level permissions for customer creation are not correctly enforced against unauthenticated requests. In terms of offensive security frameworks, this behavior corresponds to MITRE ATT&CK technique T1078 Valid Accounts when considering the abuse of system functions without proper credentials, and potentially T1565 Data Manipulation if the injected data is used to corrupt downstream processes or reports.
To mitigate this vulnerability, immediate action must be taken by applying any available patches provided by Craftplan for versions prior to 0.7.6. If patching is not immediately feasible, administrators should implement network-level controls such as Web Application Firewall rules that restrict access to the /api/json/customers endpoint and GraphQL mutation endpoints exclusively from trusted IP ranges or require explicit authentication headers at a reverse proxy level before requests reach the application server. Furthermore, developers must review all API endpoints for similar gaps in authorization logic, ensuring that every state-changing operation requires verified user identity and appropriate role-based permissions. Regular security audits focusing on access control lists and input validation mechanisms are essential to prevent recurrence of such critical flaws in future updates.