Critical BOLA Flaw Lets Attackers Hijack Webkul Krayin CRM Accounts

The National Vulnerability Database has highlighted a critical security flaw, CVE-2026-38529, impacting Webkul Krayin CRM versions up to v2.2.x. This vulnerability, classified as Broken Object-Level Authorization (BOLA), allows authenticated attackers to gain full control over user accounts.

According to the National Vulnerability Database, the vulnerability resides in the /Settings/UserController.php endpoint. By crafting specific HTTP requests, an attacker can exploit this flaw to arbitrarily reset user passwords. This leads to a complete account takeover, granting the attacker the same privileges as the compromised user. The National Vulnerability Database notes a CVSS score of 8.8, marking it as HIGH severity, with a vector indicating network accessibility, low complexity, and requiring only low privileges from the attacker.