CVE-2026-41452

CRITICAL

Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-41452 has a selected CVSS score of 9.3 (critical); EIP currently links 1 repository PoC.

Description

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert targeting the hardcoded administrator user ID, enabling full administrative access to all CRM data.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 3, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

laravel-crm

Browse krayin / laravel-crm

Default status: affected

CVE ListThrough 2.2.0affected
2.2.1 to ≤ 2.2.3unaffected
2.2.4affected

Proofs of concept

1

Repository PoCs

GitHubBoreas37/CVE-2026-41452-PoCRepository PoCby Boreas371Exploit2 files

8.2 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-41452 in Krayin CRM by sending an AJAX POST request to bypass installer middleware and overwrite the primary admin account, then logs in to confirm takeover.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a README and a Python script that demonstrate the CVE-2026-41452 authentication bypass. The script sends HTTP requests to overwrite the admin account and then logs in to confirm access. No backdoor, deceptive payload, or concealed harmful behavior is present. The code performs only the advertised exploit steps against the target CRM instance.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareKrayin CRM
Attack typesauthentication bypassaccount takeover
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively sends crafted HTTP requests to overwrite the admin account and then authenticates to confirm access, which constitutes exploitation rather than mere detection or scanning.

poc_cve-2026-41452.py:71-81poc_cve-2026-41452.py:84-103poc_cve-2026-41452.py:106-116

Requirements

  • Target Krayin CRM instance (≤2.2.0 or 2.2.4) with installer endpoint accessiblepoc_cve-2026-41452.py:4

Observed behavior

  • Sends a non-AJAX POST to /install/api/admin-config-setup to confirm the middleware blocks normal requestspoc_cve-2026-41452.py:57-68
  • Sends an AJAX POST with X-Requested-With: XMLHttpRequest header to bypass CanInstall middleware and overwrite admin user (id=1) with attacker-supplied credentialspoc_cve-2026-41452.py:71-81
  • Extracts CSRF token from /admin/login page and logs in with the overwritten credentialspoc_cve-2026-41452.py:84-103
  • Accesses /admin/dashboard to confirm successful admin takeoverpoc_cve-2026-41452.py:106-116
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Sends POST to /install/api/admin-config-setup with X-Requested-With: XMLHttpRequest to bypass middleware and overwrite admin account.This is the documented CVE exploit behavior; it targets the vulnerable CRM, not the PoC operator.poc_cve-2026-41452.py:71-77
Exploit Behavior
Logs in to /admin/login with overwritten credentials and verifies dashboard access.Standard proof-of-exploit verification; no unrelated actions.poc_cve-2026-41452.py:84-116
Review boundaries

What the analysis did not establish

  • Only the two text files (README.md and poc_cve-2026-41452.py) were reviewed; no binary files were present or analyzed.
  • The review does not assess whether the exploit works as claimed, only whether the supplied evidence contains backdoor or deceptive behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3