A role manipulation flaw in krayin Laravel‑CRM’s User Management module permits attackers to alter the role_id parameter within UserController.php, enabling users to obtain privileges beyond their intended level. This flaw is rooted in insufficient privilege validation and is classified under CWE‑266 and CWE‑269. An attacker could elevate privileges remotely, potentially accessing sensitive data or administrative functions that should be restricted.

Products affected are krayin’s Laravel‑CRM, versions up to and including 2.2.5. The vulnerable code resides in packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php, and the fix is incorporated in release 2.2.6. Users running any 2.2.5 or earlier version should consider the version as impacted.

With a CVSS score of 5.3, the overall severity is moderate, and no EPSS score is published, but the vulnerability is publicly disclosed and the exploit exists. It is not listed in the CISA KEV catalog, yet the attack vector is remote and could be leveraged by an adversary with network access to the application. When the patch is not applied, the risk remains because the attacker can modify role assignments via HTTP requests, granting unauthorized access.