CVE-2026-41452 is a critical missing authentication flaw (CVSS 9.8) in Krayin CRM 2.2.4. The installer still accepts requests after setup and can overwrite the primary administrator account. The record gives no fixed version, so block the installer routes now and watch the project for a release.
What's affected
The NVD record names Krayin CRM 2.2.4. The VulnCheck advisory lists the laravel-crm package up to 2.2.0, 2.2.1 through 2.2.3, and 2.2.4 as affected, and the Jiva Security write-up says the issue exists in 2.2.0 and earlier as well. None of the pages I read names a fixed version, so check the project's releases for one.
How to check if you're exposed
Work out your version, then test your own installation from a trusted network position to see whether installer routes under /install are still served after setup. Do not test someone else's server.
The write-up describes how the installer protection works: a middleware named CanInstall is meant to redirect once the CRM is installed, by checking for an installed marker file in storage or for database tables. Confirm that the marker file exists on your server and is readable by the application.
Then check your admin account for changes: the name, the email and any recent password change.
What to do now
- Block
/installand/install/apiat your reverse proxy or web server for any installed instance. - Check the Krayin releases for a version that fixes this, and upgrade when available.
- Verify that the admin account details are the ones you set, and reset the password if anything looks off.
- Review database and application logs for unexpected POST requests to the installer endpoints.
- Restrict the CRM to a VPN or allowed networks where users are internal only.
Why it matters
The record lists CWE-306, missing authentication for a critical function. The description says a request carrying a header typical of browser scripts can get past the redirect check in the middleware, and then an endpoint writes the given name, email and password to the hardcoded administrator record.
An installer is the most privileged page a web app has, and it must be unreachable once setup is done. Delete or block it in production. The record does not flag this CVE as known exploited. The VulnCheck advisory scores it 9.3 under CVSS 4.0, against the NVD 9.8 under 3.1.
Quick check
Is the installer really needed after setup?
No. Block or remove its routes in production, which helps even with software that has its own guard.
Sources
Last reviewed: 19 October 2026.
