Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-38529 A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily rese… https://www.cve.org/CVERecord?id=CVE-2026-38529
Post summary
A BOLA vulnerability (CVE‑2026‑38529) has been disclosed for Webkul Krayin CRM v2.2.x, allowing authenticated users to perform arbitrary actions via the /Settings/UserController.php endpoint.
⚠️ HIGH — CVE-2026-38529 A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x all… CVSS 8.8 Full analysis → https://sec.kaitan.id/cves/CVE-2026-38529 #HP #CyberSecurity #InfoSec
Post summary
The tweet announces CVE-2026-38529 as a high‑severity Broken Object‑Level Authorization in Webkul Krayin CRM v2.2.x, with no PoC, exploit, or patch details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | webkul | krayin_crm | 2.2.0 | - | - |