Krayin CRM before version 2.2.7 has a broken object‑level authorization flaw in the EmailController write actions. When an authenticated user supplies a numeric message identifier of another employee, the system allows the user to modify, resend, trash, mass‑update, or permanently delete that user’s email messages. The attacker can also read the message’s subject, body, and any linked lead or person data, effectively stealing confidential information and destroying records.

This vulnerability affects the Krayin CRM product (laravel‑crm) in all releases prior to 2.2.7. Users running any version below 2.2.7 are impacted.

The CVSS score of 7.1 ranks this issue as a high‑severity flaw, but it requires an authenticated session that has been granted limited scope. Since the EPSS score is not provided and the issue is not listed in the CISA KEV catalog, it appears to have no widespread public exploitation yet, yet the impact to confidentiality, integrity, and availability of sensitive business emails makes it a high‑risk vulnerability for organizations running the affected product.