CVE-2026-90944 in laravel-crm
Summary
by MITRE • 09/14/2026
Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in Krayin CRM versions through 2.2.6 represents a critical failure in access control mechanisms within the application's email processing subsystem. Specifically, the endpoint designated for parsing inbound emails at /admin/mail/inbound-parse is accessible without requiring any form of authentication or authorization tokens. This architectural oversight allows unauthenticated external actors to interact directly with the system's mail ingestion logic, bypassing standard security boundaries that should restrict administrative functions and data manipulation operations to verified users only. The exposure of this endpoint effectively transforms a backend processing routine into an open interface for arbitrary input injection, creating a significant attack surface for malicious exploitation.
From a technical perspective, the flaw lies in the application's inability to validate the source or identity of requests directed at the inbound mail parsing service. By accepting POST requests containing RFC 2822 formatted messages without verifying user credentials, the system permits attackers to craft and submit arbitrary email structures. These crafted messages can include forged sender information, manipulated headers, and custom subject lines. The parser processes these inputs as legitimate incoming communications, integrating them into the CRM's internal database of conversations and customer interactions. This lack of input validation combined with missing authentication checks enables a direct path for data injection that circumvents all intended security controls designed to protect administrative functions and user-specific data streams.
The operational impact of this vulnerability is severe, primarily due to the potential for social engineering attacks and reputation damage within the organization's communication channels. Attackers can inject emails that appear to originate from trusted internal or external sources by manipulating header fields such as From, Reply-To, and Subject. This capability allows adversaries to insert deceptive messages into existing conversation threads, potentially misleading employees about ongoing projects, financial statuses, or customer requests. Furthermore, the ability to reply to existing threads increases the credibility of these forged communications, making them more likely to be acted upon by unsuspecting staff members. The integrity of the CRM's communication history is compromised, leading to potential data corruption and loss of trust in the system as a source of truth for business operations.
In terms of industry classification standards, this vulnerability aligns with CWE-287, which describes Improper Authentication, specifically where an actor fails to provide valid authentication credentials before accessing restricted functionality. Additionally, it relates to CWE-94, Code Injection, in the context that arbitrary data is injected into the system's processing pipeline without sanitization or validation of its origin. From a tactical perspective on the MITRE ATT&CK framework, this exploitation technique maps to T1566.002, Spearphishing Link, and more broadly to Initial Access techniques involving trusted relationships, as attackers exploit the trust users place in email communications managed by their internal CRM systems. The attack vector is classified under Network-Based attacks with no additional privileges required for initial access, highlighting the critical nature of securing exposed administrative endpoints.
To mitigate this vulnerability, immediate remediation efforts should focus on enforcing strict authentication requirements on all administrative and backend API endpoints within Krayin CRM. Developers must implement robust identity verification checks before processing any inbound mail data through the /admin/mail/inbound-parse route. It is essential to ensure that only authenticated users with appropriate roles can trigger email parsing operations or access related configuration settings. Additionally, implementing input validation mechanisms to sanitize incoming RFC 2822 messages and verify header integrity can help prevent certain types of injection attacks. Organizations should also consider deploying web application firewalls configured to detect and block unauthorized POST requests to administrative paths until the underlying code is patched. Regular security audits and penetration testing focused on access control flaws are recommended to identify similar misconfigurations across other modules within the CRM platform.