CVE-2026-41452 in laravel-crm
Summary
by MITRE • 08/03/2026
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert targeting the hardcoded administrator user ID, enabling full administrative access to all CRM data.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability exists within Krayin CRM version 2.2.4 where the installer middleware fails to properly enforce authentication checks during the installation process. The flaw resides in the application's security architecture that allows unauthorized users to bypass the intended CanInstall middleware redirect mechanism through a simple HTTP POST request manipulation. The specific technical implementation involves the X-Requested-With: XMLHttpRequest header which, when present, causes the system to incorrectly assume the request originates from an authenticated installer context rather than validating actual user credentials.
The vulnerability stems from a missing authentication check in the admin-config-setup endpoint that processes configuration data during installation. When attackers send a crafted POST request with the XMLHttpRequest header, the system's middleware logic fails to properly validate whether the request comes from an authenticated administrator or a malicious actor attempting to exploit the installation process. The application code contains hardcoded references to a specific administrator user ID that is targeted by the updateOrInsert operation, regardless of authentication status.
The operational impact of this vulnerability is severe as it allows remote attackers to completely compromise the system's administrative privileges without requiring any prior credentials or access. Once exploited, attackers can overwrite the primary administrator account with their own credentials, gaining complete control over all CRM data, user accounts, and system configurations. This creates a persistent backdoor that remains active until the vulnerability is patched and the system is properly reconfigured.
The technical flaw aligns with CWE-287 which addresses improper authentication issues in software systems. This weakness enables privilege escalation through insecure direct object reference patterns where hardcoded user identifiers are manipulated without proper authorization checks. The vulnerability also maps to ATT&CK technique T1078 which covers valid accounts and credential access, as attackers can leverage this flaw to obtain administrative privileges and maintain persistent access to the system.
Mitigation strategies should include implementing mandatory authentication checks for all installation endpoints regardless of request headers or types. The application must validate user credentials before allowing any modification operations on critical system components including administrator accounts. Network segmentation and firewall rules should restrict direct access to installation endpoints from untrusted networks, while implementing proper input validation and sanitization to prevent parameter manipulation attacks. Regular security audits should verify that all middleware components properly enforce authentication requirements and that hardcoded identifiers are not exposed to unauthorized modification operations.