CVE-2026-41452

Name of the Vulnerable Software and Affected Versions Krayin CRM version 2.2.4

Description Missing authentication in the installer middleware allows unauthenticated remote attackers to overwrite the primary administrator account. By sending a crafted HTTP POST request containing the X-Requested-With: XMLHttpRequest header, an attacker can bypass the CanInstall middleware redirect check. This allows the submission of arbitrary name, email, and password values to the 'admin-config-setup' endpoint, which executes an unauthenticated updateOrInsert() function targeting the hardcoded administrator user ID, granting full administrative access to all CRM data.

Recommendations Update Krayin CRM to a version newer than 2.2.4.