Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via the JSON:API and GraphQL endpoints. Attackers can send anonymous POST requests to /api/json/customers or the create_customer mutation to insert attacker‑chosen names, contact details and addresses. This can lead to data integrity issues, potential privacy violations, and an attack surface for further manipulation of the CRM.

The vulnerability affects all installations of puemos Craftplan version 0.7.5 and earlier. Any deployment of Craftplan that has not applied an update removing the missing authorization check is at risk.

The CVSS score of 6.9 indicates a medium severity impact. The EPSS score indicates a very low but nonzero exploitation probability (below 1%). The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based one, where an unauthenticated attacker can simply send HTTP requests to the vulnerable endpoints. No special conditions are required beyond public access to the API.