A broken object‑level authorization flaw exists in the /Settings/UserController.php endpoint of Webkul Krayin CRM version 2.2.x. The flaw allows an attacker who has already authenticated to reset the password of any user by sending a crafted HTTP request. The ability to change a user’s password gives the attacker full control of that account, effectively enabling a complete account takeover.

Webkul Krayin CRM 2.2.x is the only product noted as affected. No other vendors or product versions are listed.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is < 1%, representing a very low but non‑zero exploitation probability, and the issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated session and the delivery of a crafted HTTP request to the exposed endpoint. Given the high severity score and the need for authentication, the risk is substantial for systems that use the vulnerable version.