Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-38532 A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitra… https://www.cve.org/CVERecord?id=CVE-2026-38532
Post summary
The text discloses CVE-2026-38532 as a BOLA issue in Webkul Krayin CRM v2.2.x, noting the affected endpoint but provides no evidence of PoC, active exploitation, or remediation.
⚠️ HIGH — CVE-2026-38532 A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v… CVSS 8.1 Full analysis → https://sec.kaitan.id/cves/CVE-2026-38532 #HP #CyberSecurity #InfoSec
Post summary
The message announces a high‑severity BOLA vulnerability (CVE‑2026‑38532) in Webkul Krayin CRM, providing technical details but no proof‑of‑concept, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | webkul | krayin_crm | 2.2.0 | - | - |