CVE-2026-61460

Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.4

Description An insecure direct object reference issue exists where authenticated users can edit, update, or delete records belonging to other users. This occurs due to missing record-level ownership validation within the edit(), update(), and destroy() methods of the following controllers: LeadController, PersonController, OrganizationController, QuoteController, and ActivityController. An attacker can exploit this to modify CRM records and reassign ownership.

Recommendations Update Krayin CRM to version 2.2.4 or later.