Krayin laravel-crm attachment-download Endpoint acl.php resource injection

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-100884 · Microsoft / collected KEV context

cve-program · CVE-2026-100884

• https://vuldb.com/vuln/410814
• https://vuldb.com/vuln/410814/cti
• https://vuldb.com/cve/CVE-2026-100884
• https://vuldb.com/submit/916218
• https://github.com/krayin/laravel-crm/issues/2624
• https://github.com/krayin/laravel-crm/pull/2627
• https://github.com/carlosalbertotuma/advisory/blob/main/advisory-06-IDOR-Email-Attachment%20Download.md
• https://github.com/krayin/laravel-crm/commit/13d6988cda8d69ece45ee1890effc90a7f21cdc1
• https://github.com/krayin/laravel-crm/releases/tag/v2.2.6
• https://github.com/krayin/laravel-crm/

No related operational record is retained in the current change model.