CVE-2026-100885
published 2026-09-27CVE-2026-100885: A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file…
PriorityP259high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EXPLOIT
EPSS
1.00%
61.4th percentile
A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 2.2.5 mitigates this issue. The patch is identified as 89f2916b6a46ff91bd1999ce38158fa0de8b9490. Upgrading the affected component is recommended.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| krayin | laravel-crm | — | — |
| krayin | laravel-crm | — | — |
| krayin | laravel-crm | — | — |
| krayin | laravel-crm | — | — |
| krayin | laravel-crm | — | — |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Krayin laravel-crm up to 2.2.4 admin-config-setup API Endpoint CanInstall.php authorization (EUVD-2026-88049)
vuldb·2026-10-01·CVSS 7.3
CVE-2026-100885 [HIGH] Krayin laravel-crm up to 2.2.4 admin-config-setup API Endpoint CanInstall.php authorization (EUVD-2026-88049)
A vulnerability described as critical has been identified in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass.
This vulnerability is cataloged as CVE-2026-100885. The attack may be launched remotely. Furthermore, there is an exploit available.
Upgrading the affected component is recommended.
GHSA
A vulnerability was found in Krayin laravel-crm up to 2.2.4.
ghsa_unreviewed·2026-09-28
CVE-2026-100885 [MEDIUM] CWE-285 A vulnerability was found in Krayin laravel-crm up to 2.2.4.
A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 2.2.5 mitigates this issue. The patch is identified as 89f2916b6a46ff91bd1999ce38158fa0de8b9490. Upgrading the affected component is recommended.
No detection rules found.
No writeups or analysis indexed.
https://github.com/carlosalbertotuma/advisory/blob/main/advisory-07-Unauthenticated-InstallerBypass.mdhttps://github.com/krayin/laravel-crm/https://github.com/krayin/laravel-crm/commit/89f2916b6a46ff91bd1999ce38158fa0de8b9490https://github.com/krayin/laravel-crm/pull/2614https://github.com/krayin/laravel-crm/releases/tag/v2.2.5https://vuldb.com/cve/CVE-2026-100885https://vuldb.com/submit/916597https://vuldb.com/vuln/410815https://vuldb.com/vuln/410815/cti
2026-09-27
Published