Vulnerability · Published Sep 14, 2026 · Assigned by VulnCheck
CVE-2026-90944Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
High 8.2
In plain English
A high-severity missing authentication in laravel-crm from krayin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.7%top 48.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| krayin | laravel-crm | 0 – through 2.2.6 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
References
- GitHub Issue #2560 issue-tracking
- https://github.com/krayin/laravel-crm product
- mail-routes.php at v2.2.6 technical-description
- bootstrap/app.php at v2.2.6 technical-description
- VulnCheck Advisory: Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse third-party-advisory