CVE-2026-38527

Webkul Krayin CRM version 2.2.x contains a Server-Side Request Forgery (SSRF) vulnerability in the /settings/webhooks/create component that enables authenticated attackers to scan and interact with internal network resources through a specially crafted POST request. This vulnerability allows bypass of network segmentation controls and potential reconnaissance of backend infrastructure. The vulnerability carries a CVSS score of 8.5 (HIGH) and requires low attack complexity with network accessibility, but does require valid user credentials to exploit. An attacker with authenticated access can achieve high confidentiality impact and limited integrity impact by probing internal systems and potentially manipulating webhook configurations. The attack does cross security boundaries, affecting the confidentiality of internal resources. There is currently no evidence of active exploitation in the wild, as indicated by the absence from the Known Exploited Vulnerabilities catalog. The EPSS score of 0.00032 suggests minimal likelihood of exploitation in the immediate term. However, the moderate FAUCET risk score of 51.0 warrants attention to patch deployment, particularly for organizations with internet-facing Krayin CRM instances where user accounts may be compromised or misused.