https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-14T17:28:29.647381+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-125374 CVE-2026-125374 — Krayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/Detach 2026-11-14T17:28:29.648334+00:00

Affected: krayin laravel-crm

Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope.