Krayin CRM < 2.2.1 - Installer Authentication Bypass

criticalseverity

9.8CVSS score

3.7%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware caused by bypassing the CanInstall middleware redirect check via crafted HTTP POST requests, letting unauthenticated remote attackers overwrite the primary administrator account and gain full administrative access, exploit requires crafted HTTP POST with specific header.

Impact

Unauthenticated attackers can gain full administrative access, compromising all CRM data and control.

Fix

Update to the latest version that patches this vulnerability.

How to confirm it

Send: GET /install
Positive when: status_code == 200 and contains_all(tolower(body), "krayin", "installation", "installer")

Run it with nuclei: nuclei -id CVE-2026-41452 -u <target>

The full check

id: CVE-2026-41452

info:
  name: Krayin CRM < 2.2.1 - Installer Authentication Bypass
  author: str4k3r
  severity: critical
  description: |
    Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware caused by bypassing the CanInstall middleware redirect check via crafted HTTP POST requests, letting unauthenticated remote attackers overwrite the primary administrator account and gain full administrative access, exploit requires crafted HTTP POST with specific header.
  impact: |
    Unauthenticated attackers can gain full administrative access, compromising all CRM data and control.
  remediation: |
    Update to the latest version that patches this vulnerability.
  reference:
    - https://github.com/krayin/laravel-crm/releases
    - https://github.com/krayin/laravel-crm/compare/v2.2.0...v2.2.1
  classification:
    cve-id: CVE-2026-41452
    epss-score: 0.03742
    epss-percentile: 0.89946
    cwe-id: CWE-287
    cvss-score: 9.8
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  metadata:
    verified: true
    max-request: 1
    vendor: webkul
    product: krayin-laravel-crm
    fofa-query: title="Krayin" || header="krayin_crm_session"
  tags: cve,cve2026,krayin,laravel,php,installer,auth-bypass

http:
  - raw:
      - |
        GET /install HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(tolower(body), "krayin", "installation", "installer")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from