vulnwire
8.2high

CVE-2026-90944

Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse

Published 53 d ago · modified 43 d ago · JSON

CVSS
8.2
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 52%
Public exploits
0
none known

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
yes
Technical impact
partial
Assessed
53 d ago

Exploit prediction (EPSS)

0.66% probability of exploitation in the next 30 days, higher than 52% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.08.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
CNA3.18.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CNA4.08.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA3.18.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Affected products

  • krayin laravel-crm

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

  • github.com /krayin/laravel-crm/issues/2560 · issue-tracking, exploit
  • github.com /krayin/laravel-crm · product
  • github.com /krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Admin/src/Routes/Admin/mail-routes.php · technical-description
  • github.com /krayin/laravel-crm/blob/v2.2.6/bootstrap/app.php · technical-description
  • vulncheck.com /advisories/krayin-crm-through-2.2.6-unauthenticated-email-injection-via-inbound-parse · third-party-advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.