CVE-2026-97895
krayin laravel-crm User Management UserController.php privileges management
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_id can lead to improper privilege management. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.6 is able to mitigate this issue. This patch is called 5469d70336fbb25e8e513683e82b32982ce8aa82. Upgrading the affected component is advised.
| CWE | CWE-269 CWE-266 |
| Vendor | krayin |
| Product | laravel-crm |
| Published | Sep 25, 2026 |
| Last Updated | Sep 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for krayin laravel-crm
Be the first to know when new medium vulnerabilities affecting krayin laravel-crm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
krayin / laravel-crm
2.2.0 2.2.1 2.2.2 2.2.3 2.2.4 2.2.5
References
vuldb.com: https://vuldb.com/vuln/409907 vuldb.com: https://vuldb.com/vuln/409907/cti vuldb.com: https://vuldb.com/cve/CVE-2026-97895 vuldb.com: https://vuldb.com/submit/915369 github.com: https://github.com/krayin/laravel-crm/issues/2616 github.com: https://github.com/krayin/laravel-crm/pull/2621 github.com: https://github.com/carlosalbertotuma/advisory/blob/main/advisory-01-privesc.md github.com: https://github.com/krayin/laravel-crm/commit/5469d70336fbb25e8e513683e82b32982ce8aa82 github.com: https://github.com/krayin/laravel-crm/releases/tag/v2.2.6 github.com: https://github.com/krayin/laravel-crm/
Credits
🔍 bl4dsc4n (VulDB User)