The vulnerable laravel-cm attachment-download endpoint uses Laravel's Storage::download with a resource identifier that is not properly validated. The description states that manipulation of the ID parameter leads to improper control of resource identifiers, and it is inferred that an attacker can bypass intended access control to retrieve arbitrary files, resulting in an IDOR that exposes sensitive documents. The attack may be initiated remotely, and the exploit has been publicly disclosed and can be used.

Krayin laravel-crm versions up to and including 2.2.5 are affected. The published fix in v2.2.6 contains a commit that restricts ID manipulation and therefore resolves the issue.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack can be initiated remotely; the attacker simply sends a crafted request to the endpoint with an altered identifier. Since the flaw relies on public parameters and a publicly disclosed exploit exists, the risk to confidentiality for exposed deployments remains significant.