Is CVE-2026-112286 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-112286?

CVE-2026-112286 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-112286

Description

Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve quote addresses, totals, contact details, and product pricing belonging to any user or lead.