ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-90944

Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse

CVSS 4.0 8.8 HIGHCVSS 3.1 8.2 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-90944

Published

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-90944

Published

laravel-crm

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "krayin",
                    "product": "laravel-crm",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:composer/krayin/laravel-crm",
                    "versions": [
                        {
                            "version": "0",
                            "lessThanOrEqual": "2.2.6",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ],
                    "repo": "https://github.com/krayin/laravel-crm"
                }

Original source record · Cite this exact observation · Complete original publisher JSON