Description
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send via is_draft=0, trash or permanently delete emails and disclose their subject, body and linked lead and person data.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
krayin laravel-crm
Default version status: unaffected
0 to < 2.2.7affected
pkg:composer/krayin/laravel-crmReferences
- https://github.com/krayin/laravel-crm/pull/2683 ↗
- https://github.com/krayin/laravel-crm/commit/64b9125f33a7eb2ef9916d0e5fd8215c7f6a8c28 ↗
- https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Admin/src/Http/Controllers/Mail/EmailController.php ↗
- https://github.com/krayin/laravel-crm/releases/tag/v2.2.7 ↗
- https://www.vulncheck.com/advisories/krayin-crm-before-2.2.7-broken-object-level-authorization-in-mail-module ↗