The vulnerability is a Broken Object-Level Authorization flaw located in the /Settings/UserController.php endpoint of Webkul Krayin CRM. An authenticated attacker can send a crafted HTTP request to reset any user’s password, thereby gaining full control over that account. This is an improper access control weakness that can lead to complete account compromise.

Webkul Krayin CRM version 2.2.x is affected. No other vendors or product versions are listed. The flaw exists specifically in the Settings controller handling user data within that version.

The CVSS score of 8.8 indicates high severity, with potential for full account takeover. Because the flaw requires an already authenticated session, it is not a remote unauthenticated vulnerability, but once the attacker has basic credentials they can exploit the weakness. No EPSS data is available, and the flaw is not yet listed in the CISA KEV catalog, suggesting it may not be publicly exploited yet; however, its high CVSS score makes it a priority for mitigation.