CVE-2026-125374

Description

Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/krayin/laravel-crm/commit/3cfa2f763563723469dd1cb7ab53e51b269139bc ↗
• https://github.com/krayin/laravel-crm ↗
• https://github.com/krayin/laravel-crm/blob/999b596d0f53cb11c9b029f733a1d67e01fccda6/packages/Webkul/Admin/src/Http/Controllers/Lead/TagController.php#L26-L55 ↗
• https://github.com/krayin/laravel-crm/commit/95e0dbc83a72933aeaf72190a0f570ea1ddcc452 ↗
• https://github.com/krayin/laravel-crm/releases/tag/v2.2.8 ↗
• https://www.vulncheck.com/advisories/krayin-crm-before-2.2.8-broken-object-level-authorization-via-lead-tag-attach-detach ↗