CVE-2026-110630Medium· 6.5▾ SunlitVentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can as…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110629Medium· 6.5VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods
CVE-2026-112287High· 7.1Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module
CVE-2026-112288Low· 3.3Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
CVE-2026-112286Medium· 6.5Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints
CVE-2026-100883Medium· 6.3A flaw has been found in Krayin laravel-crm up to 2.2.5
CVE-2026-100884Medium· 4.3A vulnerability has been found in Krayin laravel-crm up to 2.2.5