CVE-2026-97895

Katalog CVE

CVSS 6.3 · Medium EPSS 0,27%

Kerentanan Incorrect Privilege Assignment. Skor CVSS 3.1 6.3 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_id can lead to improper privilege management. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.6 is able to mitigate this issue. This patch is called 5469d70336fbb25e8e513683e82b32982ce8aa82. Upgrading the affected component is advised.

Rincian

Terbit di NVD

25 September 2026

Terakhir diubah

28 September 2026

Status NVD

Deferred

CVSS 3.1

6.3 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-269: Improper Privilege Management

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/carlosalbertotuma/advisory/blob/main/advisory-01-privesc.md
• https://github.com/krayin/laravel-crm/
• https://github.com/krayin/laravel-crm/commit/5469d70336fbb25e8e513683e82b32982ce8aa82
• https://github.com/krayin/laravel-crm/issues/2616
• https://github.com/krayin/laravel-crm/pull/2621
• https://github.com/krayin/laravel-crm/releases/tag/v2.2.6
• https://vuldb.com/cve/CVE-2026-97895
• https://vuldb.com/submit/915369
• https://vuldb.com/vuln/409907
• https://vuldb.com/vuln/409907/cti