CVE-2026-97895 in laravel-crm
Summary
by MITRE • 09/25/2026
A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_id can lead to improper privilege management. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.6 is able to mitigate this issue. This patch is called 5469d70336fbb25e8e513683e82b32982ce8aa82. Upgrading the affected component is advised.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in Krayin Laravel CRM versions up to 2.2.5 represents a critical failure in access control mechanisms within the User Management subsystem. Specifically, this flaw resides in the UserController located at packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php and involves improper privilege management when handling role assignments. The core technical issue stems from an insufficient validation of the role_id argument during user creation or modification operations. Because the application fails to adequately verify that the requesting administrator possesses the necessary permissions to assign specific roles, it allows for a manipulation of this parameter by attackers with lower-level privileges. This lack of server-side authorization checks means that any authenticated user can potentially escalate their own privileges or those of other users by simply altering the role_id field in HTTP requests directed at the relevant endpoints.
From an operational perspective, this vulnerability enables remote privilege escalation attacks without requiring physical access to the system. An attacker who has obtained valid credentials for a standard user account could exploit this flaw to grant themselves administrative rights or assign critical roles that were previously restricted. The impact of such unauthorized role assignment is severe, as it compromises the integrity and confidentiality of the entire CRM environment. Once an attacker achieves elevated privileges, they can access sensitive customer data, modify business-critical configurations, create backdoors for persistent access, or delete essential records. Given that this exploit has been publicly disclosed, automated scanning tools and malicious actors are likely to actively probe systems running affected versions, significantly increasing the risk of compromise in production environments where Krayin is deployed.
This vulnerability aligns with CWE-269, which classifies Improper Privilege Management, as it involves a failure to enforce proper authorization checks before granting elevated access rights. Furthermore, from an offensive security framework perspective such as MITRE ATT&CK, this flaw facilitates the T1078 Valid Accounts technique and potentially contributes to privilege escalation pathways by allowing lateral movement within the application through role manipulation. The absence of robust input validation on critical administrative parameters like role identifiers is a common pattern in web applications that rely heavily on client-side controls or insufficient server-side policy enforcement.
To mitigate this risk, immediate action is required to upgrade Krayin Laravel CRM to version 2.2.6 or later. This specific release includes the patch identified by commit hash 5469d70336fbb25e8e513683e82b32982ce8aa82, which addresses the underlying logic error in the UserController. The fix likely involves implementing strict server-side authorization checks to ensure that only users with explicit administrative permissions can assign or modify role assignments for other accounts. Organizations should verify their deployment versions and apply this update promptly. Additionally, it is advisable to review access logs for any suspicious activity related to user management endpoints prior to patching, as the public disclosure of the exploit increases the likelihood of active exploitation attempts against unpatched systems.