VulnSocial

CVE-2026-38530Disclosure(webkul / krayin_crm)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.

webkul CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-639

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • krayin_crm

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-04-14); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
webkul
Products
krayin_crm

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-04-14: 1Mentions · 2026-04-19: 1Technical Details · 2026-04-14: 1Technical Details · 2026-04-19: 104-1404-19
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-38530 A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrar… https://www.cve.org/CVERecord?id=CVE-2026-38530

    Post summary

    The text announces CVE-2026-38530 as a BOLA vulnerability in Webkul Krayin CRM v2.2.x, detailing the affected endpoint and potential impact, but provides no PoC, exploit code, active exploitation evidence, or patch information.

    00000149
    57.2K followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    ⚠️ HIGH — CVE-2026-38530 A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2… CVSS 8.1 Full analysis → https://sec.kaitan.id/cves/CVE-2026-38530 #HP #CyberSecurity #InfoSec

    Post summary

    CVE-2026-38530 is a high‑severity Broken Object‑Level Authorization flaw in Webkul Krayin CRM v2’s LeadController endpoint; the post provides technical details but no PoC, exploit, active exploitation, or patch information.

    000000
    144 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appwebkulkrayin_crm2.2.0--

Explore more

Back to dashboardwebkul CVEskrayin_crm vulnerabilities