The flaw in Krayin laravel-crm’s acl.php allows remote actors to manipulate an internal function, resulting in improper access control. The vulnerability can let an attacker gain unauthorized access to administrative functions or sensitive data, exploiting weaknesses in authorization and privilege escalation. This can compromise confidentiality and integrity by allowing privileged actions that should be restricted.

The vulnerability affects Krayin’s laravel-crm product in all releases prior to version 2.2.6, including the 2.2.5 release bundle. Upgrading to v2.2.6, which incorporates commit a399404a388d8ad2700a01349d0d98069c8e85a4, removes the flaw.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score is not available and the issue is not listed in CISA KEV. The attack can be launched remotely by manipulating the undocumented function in acl.php; published proof‑of‑concepts suggest the exploit can be triggered from outside the application without authentication. Successful exploitation would allow an attacker to elevate privileges or access protected data on the affected system.