CVE-2026-100883

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100883
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100883.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100883
Published
2026-09-27T22:15:08Z
Modified
2026-09-30T03:31:06Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Krayin laravel-crm acl.php access control
Details

A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file packages/Webkul/Admin/src/Config/acl.php. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been published and may be used. Upgrading to version 2.2.6 is sufficient to fix this issue. This patch is called a399404a388d8ad2700a01349d0d98069c8e85a4. The affected component should be upgraded.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-266",
        "CWE-284"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100883.json"
}
References

Affected packages

Git / github.com/krayin/laravel-crm

Affected ranges

Type
GIT
Repo
https://github.com/krayin/laravel-crm
Events
Introduced
a282e7c3cf969bf10ccc8ebd636be502a58a5a9b
Fixed
a399404a388d8ad2700a01349d0d98069c8e85a4
Fixed
e597417bbc537cbd9716e7f1342d65dc21ac2145
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.2.0"
        },
        {
            "last_affected":  "2.2.0"
        },
        {
            "introduced":  "2.2.1"
        },
        {
            "last_affected":  "2.2.1"
        },
        {
            "introduced":  "2.2.2"
        },
        {
            "last_affected":  "2.2.2"
        },
        {
            "introduced":  "2.2.3"
        },
        {
            "last_affected":  "2.2.3"
        },
        {
            "introduced":  "2.2.4"
        },
        {
            "last_affected":  "2.2.4"
        },
        {
            "introduced":  "2.2.5"
        },
        {
            "last_affected":  "2.2.5"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
v2.*
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100883.json"