CVE-2026-112287

{
  "etk_id": "ETK-2026-2169",
  "cve_id": "CVE-2026-112287",
  "display_id": "CVE-2026-112287",
  "ghsa_id": "GHSA-c5rj-qvgf-xg6f",
  "euvd_id": "EUVD-2026-104286",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Broken object-level authorization in Krayin Laravel CRM email actions",
  "summary": "Krayin Laravel CRM versions before 2.2.7 do not consistently enforce ownership or scope checks for email write actions. An authenticated user with limited access may access or modify other users' emails, including associated lead and person information, when targeting records outside their assigned scope.",
  "mitigation": "Upgrade laravel-crm to version 2.2.7 or later. Until the upgrade is complete, restrict access to email write functions for accounts that do not require them and review email activity for unauthorized changes.",
  "vendor": "krayin",
  "product": "laravel-crm",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.2.7"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.2.7"
      ],
      "package_name": "laravel-crm",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.002,
  "epss_percentile": 0.092,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 26.01526405,
  "t0_at": "2026-10-19T13:55:30.623000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-20T12:38:33.563396+00:00",
      "days": 0.9465618101388888,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T13:55:30.623000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-19T13:55:30.623000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T13:55:30.623000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112287"
    }
  }
}