CVE-2026-100883
published 2026-09-27CVE-2026-100883: A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php…
PriorityP342medium6.3CVSS 3.1
AVNACLPRLUINSUCLILAL
EPSS
0.46%
37.5th percentile
A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been published and may be used. Upgrading to version 2.2.6 is sufficient to fix this issue. This patch is called a399404a388d8ad2700a01349d0d98069c8e85a4. The affected component should be upgraded.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| krayin | laravel-crm | — | — |
| krayin | laravel-crm | — | — |
| krayin | laravel-crm | — | — |
| krayin | laravel-crm | — | — |
| krayin | laravel-crm | — | — |
| krayin | laravel-crm | — | — |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw has been found in Krayin laravel-crm up to 2.2.5.
ghsa_unreviewed·2026-09-28
CVE-2026-100883 [LOW] CWE-266 A flaw has been found in Krayin laravel-crm up to 2.2.5.
A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been published and may be used. Upgrading to version 2.2.6 is sufficient to fix this issue. This patch is called a399404a388d8ad2700a01349d0d98069c8e85a4. The affected component should be upgraded.
VulDB
Krayin laravel-crm up to 2.2.5 acl.php access control (Issue 2623 / EUVD-2026-88047)
vuldb·2026-09-28·CVSS 6.3
CVE-2026-100883 [MEDIUM] Krayin laravel-crm up to 2.2.5 acl.php access control (Issue 2623 / EUVD-2026-88047)
A vulnerability labeled as critical has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls.
This vulnerability is tracked as CVE-2026-100883. The attack can be launched remotely. Moreover, an exploit is present.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/carlosalbertotuma/advisory/blob/main/advisory-05-Missing-Function-Level%20Authorization.mdhttps://github.com/krayin/laravel-crm/https://github.com/krayin/laravel-crm/commit/a399404a388d8ad2700a01349d0d98069c8e85a4https://github.com/krayin/laravel-crm/issues/2623https://github.com/krayin/laravel-crm/pull/2626https://github.com/krayin/laravel-crm/releases/tag/v2.2.6https://vuldb.com/cve/CVE-2026-100883https://vuldb.com/submit/916128https://vuldb.com/vuln/410813https://vuldb.com/vuln/410813/cti
2026-09-27
Published