An authenticated BOLA vulnerability in Webkul Krayin CRM enables unauthorized access and manipulation of sensitive contact data, posing a high risk to data integrity.

This is a Broken Object-Level Authorization (BOLA) flaw occurring within the /Contact/Persons/PersonController.php endpoint, which fails to properly validate permissions for authenticated users during GET requests.

The ability to arbitrarily read, modify, or delete any contact record within a CRM system represents a significant threat to data privacy and business operations. Given the CVSS score of 8.1, this vulnerability is classified as High severity because it allows attackers to compromise the confidentiality and integrity of customer databases, potentially leading to regulatory non-compliance and reputational damage.

Immediate Action: As no official patch is currently available, administrators should restrict access to the CRM interface to trusted networks and implement strict internal controls to monitor user behavior.

Proactive Monitoring: Security teams should review application access logs for unusual patterns of GET requests targeting the PersonController, particularly those involving unexpected contact IDs.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to inspect and block unauthorized requests directed at the /Contact/Persons/PersonController.php endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security advisory hosted on the TREXNEGRO GitHub repository.

Due to the lack of a vendor-supplied patch, organizations utilizing Krayin CRM 2.2.0 or earlier must prioritize isolating the application and implementing strict access controls. Monitor for vendor updates regarding a permanent fix and apply it immediately upon release to remediate this high-risk authorization flaw.