A high-severity Broken Object-Level Authorization vulnerability in Webkul Krayin CRM exposes sensitive lead data to unauthorized modification or deletion by authenticated users.

This vulnerability is a Broken Object-Level Authorization (BOLA) flaw located in the /Controllers/Lead/LeadController.php endpoint. It allows any authenticated user to manipulate lead records belonging to other users by supplying crafted GET requests to the application.

The ability for unauthorized users to read, modify, or permanently delete lead data presents a significant risk to data integrity and business continuity. With a CVSS score of 8.1, the vulnerability is categorized as High, reflecting the potential for widespread unauthorized data access and the destruction of critical customer relationship information.

Immediate Action: As no official patch is currently available, administrators should restrict access to the Krayin CRM instance to trusted users and implement strict network-level access controls.

Proactive Monitoring: Review application access logs for anomalous GET request patterns directed at the LeadController endpoint, specifically looking for attempts to access lead IDs not associated with the active session.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to inspect and block unauthorized requests to the /Controllers/Lead/LeadController.php path.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced security advisory by TREXNEGRO.

Given the High severity of this vulnerability and the confirmed existence of a public proof-of-concept, organizations using Krayin CRM version 2.2.x must treat this as a priority issue. Until a vendor-supplied patch is released, immediate implementation of compensating controls and enhanced monitoring of the affected controller is essential to prevent unauthorized data manipulation.