HIGH

CVE-2026-90944

2026-09-14 CVSS v3.1

CVSS

8.2

Description

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.

Weakness (CWE)

CWE-306 Missing Authentication

EPSS Score

0.71%

Probability of exploitation in next 30 days

52.2th percentile

References

https://github.com/krayin/laravel-crm https://github.com/krayin/laravel-crm/blob/v2.2.6/bootstrap/app.php https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Admin/src/Routes/Admin/mail-routes.php https://github.com/krayin/laravel-crm/issues/2560 https://www.vulncheck.com/advisories/krayin-crm-through-2.2.6-unauthenticated-email-injection-via-inbound-parse

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE