A critical Broken Object-Level Authorization vulnerability in Webkul Krayin CRM allows authenticated attackers to achieve total account takeover.

This vulnerability is a Broken Object-Level Authorization (BOLA) flaw located within the /Settings/UserController.php endpoint. By sending a crafted HTTP request, an authenticated attacker can bypass authorization controls to reset the password of any user, leading to a complete account takeover.

The ability for an authenticated user to perform a full account takeover of any other user, including administrative accounts, represents a severe risk to organizational data integrity and confidentiality. Given the CVSS score of 8.8, this vulnerability is classified as High severity. Successful exploitation could lead to unauthorized access to sensitive CRM data, modification of business records, and complete compromise of the application environment.

Immediate Action: As no official fix is currently available, administrators should restrict access to the /Settings/UserController.php endpoint at the network or application firewall level to prevent unauthorized requests.

Proactive Monitoring: Monitor server access logs for anomalous POST or PUT requests directed at the /Settings/UserController.php file, particularly those involving unusual user IDs or password reset parameters.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter and block requests that exhibit patterns of object-level identifier manipulation in the CRM settings module.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security advisory hosted on the TREXNEGRO GitHub repository.

Due to the severity of this account takeover vulnerability and the lack of an immediate vendor patch, organizations must prioritize limiting exposure of the Krayin CRM instance. We recommend isolating the application from external networks where possible and enforcing strict monitoring until the vendor releases a secure version. Immediate attention is required to mitigate the risk of unauthorized account access.