Krayin CRM versions prior to 2.2.7 contain an insecure direct object reference that permits authenticated users with limited permissions to access the quotes of any other user. By invoking the quote search and lead‑products endpoints, an attacker can retrieve the address, total, contact information, and product pricing associated with other users’ quotes, exposing sensitive business data. This vulnerability is categorized as CWE‑639, reflecting a failure to enforce proper authorization checks.

The affected product is Krayin CRM for Laravel (krayin:laravel-crm) and applies to any release earlier than version 2.2.7, including 2.2.6. The fix is included in the 2.2.7 release and is available from the official project releases.

The CVSS score of 7.1 indicates medium‑to‑high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must already be authenticated and the attack vector is the web application’s quote search and lead‑products endpoints. The exploitation path requires only sending crafted requests to those endpoints; no additional privileges or system compromise are required beyond the user’s normal authentication context.