Krayin CRM 2.2.4 contains a missing authentication vulnerability in its installer middleware, allowing unauthenticated attackers to overwrite the primary administrator account. By sending a crafted HTTP POST request to the admin-config-setup endpoint with the X-Requested-With: XMLHttpRequest header, an attacker can supply arbitrary name, email, and password values. This results in full administrative access to all CRM data, effectively enabling an attacker to control the system.

The vulnerability impacts the Krayin CRM product delivered under the vendor name krayin:laravel-crm. Version 2.2.4 is explicitly affected; no additional version ranges are listed in the available data. Customers should verify if their deployed instance runs this version or any earlier releases that have not been patched.

The CVSS score of 9.3 reflects the critical nature of this flaw, and the EPSS score is not available, so the exact likelihood of exploitation cannot be quantified. Based on the description, it is inferred that the attacker’s access is remote and unauthenticated, exploiting a missing authentication check (CWE‑306) in a publicly accessible installer endpoint. The vulnerability is not listed in CISA KEV, but its high severity and ease of exploitation suggest that an attacker with minimal effort could gain full administrative control if the endpoint remains exposed.