Vulnerability Description
Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/krayin/laravel-crm
- https://github.com/krayin/laravel-crm/blob/v2.2.6/bootstrap/app.php
- https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Admin/src/Rout
- https://github.com/krayin/laravel-crm/issues/2560
- https://www.vulncheck.com/advisories/krayin-crm-through-2.2.6-unauthenticated-em
- https://github.com/krayin/laravel-crm/issues/2560
FAQ
What is CVE-2026-90944?
CVE-2026-90944 is a vulnerability with a CVSS score of 8.2 (HIGH). Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can sup...
How severe is CVE-2026-90944?
CVE-2026-90944 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-90944?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.