CVE-2026-38529

BRIEFING NOTE: CVE-2026-38529 Webkul Krayin CRM version 2.2.x contains a Broken Object-Level Authorization vulnerability in the /Settings/UserController.php endpoint that enables authenticated attackers to reset arbitrary user passwords and achieve complete account takeover by submitting specially crafted HTTP requests. The vulnerability carries a CVSS score of 8.8 (HIGH) with network accessibility and low attack complexity, requiring only valid authentication credentials but no user interaction. Successful exploitation grants attackers high-impact capabilities across confidentiality, integrity, and availability, allowing unauthorized access to compromised user accounts and sensitive CRM data. Active exploitation appears unlikely at this time. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and shows minimal community attention relative to other disclosed CVEs, with an EPSS score indicating it ranks lower than approximately 99.87% of all reported vulnerabilities. However, the straightforward nature of the BOLA flaw and moderate FAUCET risk score of 52.0 suggest organizations running affected versions should prioritize patching to prevent potential abuse by insider threats or compromised internal accounts.