An unauthenticated email injection vulnerability in Krayin Laravel CRM allows remote attackers to compromise the integrity of communication logs and conversation threads.

The application exposes the POST /admin/mail/inbound-parse endpoint without authentication or CSRF protection, enabling unauthenticated remote attackers to inject arbitrary RFC 2822 email messages into the system.

The ability to inject arbitrary emails into a CRM system creates significant risks for business operations, including social engineering, phishing, and the manipulation of client communication history. Given the CVSS score of 8.2, this high-severity vulnerability could lead to fraudulent activity, reputational damage, and the compromise of legitimate customer support workflows by allowing attackers to spoof replies to existing conversation threads.

Immediate Action: Since a specific patch version is not currently available, administrators should restrict access to the /admin/mail/inbound-parse endpoint at the network or web server level until the vendor releases a security update.

Proactive Monitoring: Review web access logs for anomalous POST requests directed at the /admin/mail/inbound-parse endpoint and monitor CRM logs for unexpected or unauthorized email entries.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized traffic to the identified vulnerable endpoint, effectively acting as a virtual patch while awaiting official remediation.

Public Exploit Available: No

Given the high CVSS score and the ease of exploitation, this vulnerability poses a clear and present risk to CRM data integrity. Organizations should prioritize restricting access to the vulnerable endpoint immediately and actively monitor for any signs of unauthorized email injection until the vendor provides a formal patch.