CVE-2026-38530 — HIGH (8.1)

Vulnerability Description

A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.

CVSS Score

8.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Webkul	Krayin Crm	2.2.0

Related Weaknesses (CWE)

CWE-639

References

https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2026-38530ExploitMitigationThird Party Advisory
https://github.com/krayin/laravel-crmProduct

FAQ

What is CVE-2026-38530?

CVE-2026-38530 is a vulnerability with a CVSS score of 8.1 (HIGH). A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently ...

How severe is CVE-2026-38530?

CVE-2026-38530 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-38530?

Check the references section above for vendor advisories and patch information. Affected products include: Webkul Krayin Crm.