A flaw exists in the newly installed admin-config-setup API endpoint of the Krayin laravel‑crm system that allows an attacker to bypass the authorization checks normally required for sensitive configuration changes. The vulnerability originates in the packages/Webkul/Installer/src/Http/Middleware/CanInstall.php component, which has incorrectly treated certain inputs as privileged, leading to a classic authorization bypass as defined by CWE‑285 and simple privilege escalation as described by CWE‑639. The attack can be performed remotely and, because the vulnerability is not tied to privileged local access, an unauthenticated user can exploit it as long as the endpoint is reachable.

Products affected are the Krayin laravel‑crm application, versions up to and including 2.2.4. The fix was released in version 2.2.5 and subsequent releases. Organisations using the 2.2.4 or earlier releases are vulnerable until they update to a patched version.

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit is publicly disclosed and the endpoint is accessible over the network, the likelihood of attack is significant for organizations that have deployed the affected version without additional network restrictions.