A broken object‑level authorization flaw in the LeadController of Webkul Krayin CRM permits an authenticated attacker to supply a crafted GET request that reveals, modifies, or permanently deletes any lead owned by another user. The vulnerability compromises confidentiality by allowing unauthorized read access, integrity through unauthorized modifications, and availability through permanent removal of lead records, affecting all three security categories.

Webkul Krayin CRM version 2.2.x is affected. The vendor is Webkul and the product is Krayin CRM. No other product or version information is supplied.

The CVSS score of 8.1 indicates high severity. EPSS is not available and the issue does not appear in the CISA KEV catalog. The description indicates that the attack requires authentication, so an attacker must log in before exploiting the flaw. The attack can be carried out by sending a specially constructed GET request to the vulnerable endpoint. Given the high impact and the need for authentication, the risk is substantial for systems where many users have access to the application.