Description
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert targeting the hardcoded administrator user ID, enabling full administrative access to all CRM data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| krayin | laravel-crm | ≤ 2.2.0, 2.2.4 | 2.2.1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
Boreas37/CVE-2026-41452-PoC ★ 4 · Aug 12, 2026
CVE-2026-41452 — Krayin CRM unauth installer bypass (X-Requested-With) → admin takeover. Verified: overwrite + login on 2.2.4, blocked on 2.2.5
-
o-sec/CVE-2026-41452-poc ★ 0 · Sep 20, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Krayin CRM < 2.2.1 - Installer Authentication Bypass http/cves/2026/CVE-2026-41452.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- Researcher Disclosure technical-description exploit
- https://www.vulncheck.com/advisories/krayin-crm-missing-authentication-via-install-api-admin-config-setup third-party-advisory