CVE-2026-90944— Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
Quick assessment
Affected
krayin laravel-crm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Krayin CRM 2.2.6 版本存在一个漏洞： 端点未在认证状态下暴露，使得未经身份验证的攻击者能够将任意电子邮件注入 CRM 收件箱。攻击者可以发送经过构造的符合 RFC 2822 规范的邮件，其中包含伪造的发件人信息和标头，从而插入具有任意主题和正文的邮件，甚至可以作为现有会话线程的回复进行插入。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| krayin | laravel-crm | ≤ 2.2.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90944
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
Source: CVE Program / CVE List V5
Vulnerability Description
Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| krayin | laravel-crm | 0 ~ 2.2.6 | - |
|
II. Public POCs for CVE-2026-90944
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90944
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-90944 (2)
-
-
🔗 laravel-crm/bootstrap/app.php at v2.2.6 · krayin/laravel-crm · GitHub Read full article technical-description
Vendor Advisories for CVE-2026-90944 (2)
IV. Related Vulnerabilities
Same product: laravel-crm
-
CVE-2026-41453
Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php -
CVE-2026-41452
Krayin CRM 2.2.4 Missing Authentication via install/api/admi -
CVE-2026-61460
Krayin CRM Insecure Direct Object Reference via Controllers -
CVE-2026-5370
krayin laravel-crm Activities Module/Notes inbox.spec.ts com
Same vendor: krayin
-
CVE-2026-41453
Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php -
CVE-2026-41452
Krayin CRM 2.2.4 Missing Authentication via install/api/admi -
CVE-2026-61460
Krayin CRM Insecure Direct Object Reference via Controllers -
CVE-2026-5370
krayin laravel-crm Activities Module/Notes inbox.spec.ts com
Same weakness: CWE-306
-
CVE-2026-59178
ESPHome Device Builder: Renamed auth env vars silently disab -
CVE-2026-57127
praisonai: recipe serve auth middleware silently disables it -
CVE-2026-57123
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentic -
CVE-2026-57128
PraisonAI: Unauthenticated Event Injection via SSE `/publish -
CVE-2026-57125
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypas
V. Comments for CVE-2026-90944
No comments yet