CVE-2026-41452: Critical Vulnerability in Krayin CRM Allows Account Takeover
This text was generated using artificial intelligence (AI).A critical vulnerability with the identifier CVE-2026-41452 identified, which, according to the initial report from Jiva Security, have a CVSS score of 9.3 (CVSS 4.0, NVD validation pending). The vulnerability affects version 2.2.4 and allows unauthenticated attackers to take over the primary administrator account and thereby gain full access to all data stored in the system.
The vulnerability stems from an inadequate authentication check in the Krayin CRM installation routine. A component that should only be accessible during the initial setup remains accessible even on systems that have already been installed. Attackers can exploit this vulnerability by sending a specially crafted HTTP POST request to the endpoint /admin-config-setup send, as in the Jiva Security Write-up described in detail.
By adding the header X-Requested-With: XMLHttpRequest A security check is bypassed. This allows the function for configuring the administrator account to be executed again. Attackers can specify a new username, email address, and password for the administrator in their request. The application then overwrites the existing administrator credentials without requiring authentication. As a result, attackers can log in using the new credentials and gain full control over the CRM system, including sensitive customer data, contract details, and internal communications.
Krayin CRM has already drawn attention on several occasions in recent months due to critical security vulnerabilities: In April 2026, vulnerabilities including CVE-2026-38526 (Remote Code Execution, CVSS 9.9) and CVE-2026-38529 (account takeover via broken object-level authorization, CVSS 8.8) were disclosed. This underscores the need for continuous third-party risk management for all organizations that use Krayin CRM or are evaluating it as third-party software. Sources: SOCRadar – CVE-2026-38526, SentinelOne – CVE-2026-38529.
Recommended Measures for Operators
Companies using Krayin CRM version 2.2.4 should take immediate action to secure their systems.
Immediate measures:
Identify and update systems: Check all instances of Krayin CRM for the affected version 2.2.4. According to the official CHANGELOG, the vendor has provided a fix for the authentication bypass in a subsequent release of the 2.2.x series; the latest known stable version is v2.2.3 or higher (the exact assignment of the fix to CVE-2026-41452 is still pending). Update to the latest available version.
Short-term protection:
Restrict access: If an immediate update is not possible, access to the installer endpoint should be /admin-config-setup be blocked at the network level or via a Web Application Firewall (WAF) to mitigate the attack vector.
Note for companies in Germany and the EU: Anyone who self-hosts Krayin CRM and processes personal data is subject to the GDPR reporting obligation under Article 33 of the GDPR (72-hour deadline to notify the competent supervisory authority) in the event of a successful attack. In addition, organizations subject to NIS 2 may be required, as part of their due diligence obligations, to promptly remediate critical vulnerabilities.
How EASM Identifies Vulnerable CRM Systems
Vulnerabilities such as CVE-2026-41452 primarily affect systems that are directly accessible from the Internet. These are often undocumented or forgotten installations (shadow IT) that were set up as part of projects or by individual departments and are not subject to central IT management.
An External Attack Surface Management (EASM) platform such as LocateRisk continuously and automatically inventories all of a company’s externally accessible IT systems. This process also identifies self-hosted applications such as Krayin CRM that are operated under the company’s own domain or within associated IP ranges. The automated detection of such systems provides security managers with a complete overview of their actual attack surface. This enables them to proactively identify affected CRM instances and implement the necessary security measures before a vulnerability can be exploited.
LocateRisk is a solution developed and hosted in Germany that is operated in compliance with data protection regulations and helps users meet GDPR, BSI IT-Grundschutz, and NIS 2 requirements.
According to the initial report by Jiva Security, CVE-2026-41452 refers to a missing authentication check in the installer middleware of Krayin CRM 2.2.4. Unauthenticated attackers can exploit this vulnerability by sending a specially crafted HTTP POST request with the header X-Requested-With: XMLHttpRequest Bypass the CanInstall middleware check and overwrite the primary administrator account with any login credentials.
This affects only Krayin CRM version 2.2.4. The vendor's official CHANGELOG confirms that an authentication bypass in the installer has been fixed in a subsequent release of the 2.2.x series; the latest known stable version is v2.2.3 or higher. As of the publication of this article, the patch has not yet been formally assigned to CVE-2026-41452. Administrators should update to the latest available version immediately.
As an immediate measure, the endpoint should /admin-config-setup be blocked at the network level or via a Web Application Firewall (WAF) so that it is not accessible from the outside. In addition, it is recommended to check all active administrator credentials for unauthorized changes and to examine access log entries for suspicious POST requests to the specified endpoint.
As of August 3, 2026. This post is intended for general informational purposes only and does not constitute legal, security, or operational advice in specific cases. The security situation and patch availability may have changed since publication; the linked vendor advisory is always authoritative. Despite careful research, we do not guarantee that the information is up-to-date, accurate, or complete.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
A rough estimate in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2024-3094
Passive Assessment
Information About the CVENotes found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français