PT-2026-99094

CVE-2026-97895

Published

2026-09-25

Updated

2026-09-25

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions krayin laravel-crm versions prior to 2.2.6

Description Improper privilege management exists within the User Management component, specifically in the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php. A remote attacker can exploit this by manipulating the role id argument.

Recommendations Update to version 2.2.6.

Exploitability

Exploit

Fix

Impacts

Researchers

Bl4Dsc4N

Vendors

Affected products

Weakness enumeration

CWE-266: Incorrect Privilege Assignment

CWE-269: Improper Privilege Management