CVE-2026-100885

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100885
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100885.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100885
Published
2026-09-27T22:45:19Z
Modified
2026-09-29T03:47:25Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization
Details

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 2.2.5 mitigates this issue. The patch is identified as 89f2916b6a46ff91bd1999ce38158fa0de8b9490. Upgrading the affected component is recommended.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-285",
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100885.json"
}
References

Affected packages

Git / github.com/krayin/laravel-crm

Affected ranges

Type
GIT
Repo
https://github.com/krayin/laravel-crm
Events
Introduced
a282e7c3cf969bf10ccc8ebd636be502a58a5a9b
Fixed
89f2916b6a46ff91bd1999ce38158fa0de8b9490
Fixed
f52d571d8f1b19c86eb928959b66f3c421cf3ea6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.2.0"
        },
        {
            "last_affected":  "2.2.0"
        },
        {
            "introduced":  "2.2.1"
        },
        {
            "last_affected":  "2.2.1"
        },
        {
            "introduced":  "2.2.2"
        },
        {
            "last_affected":  "2.2.2"
        },
        {
            "introduced":  "2.2.3"
        },
        {
            "last_affected":  "2.2.3"
        },
        {
            "introduced":  "2.2.4"
        },
        {
            "last_affected":  "2.2.4"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
v2.*
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100885.json"