CVE-2026-100885

Executive Summary

CVE-2026-100885 is an authorization bypass vulnerability in Krayin laravel-crm versions up to and including 2.2.4, specifically affecting the packages/Webkul/Installer/src/Http/Middleware/CanInstall.php file within the admin-config-setup API endpoint component. The flaw allows a remote, unauthenticated attacker (CVSS PR:N, AV:N) to circumvent access controls intended to prevent re-execution or unauthorized access to the setup/installation workflow, potentially enabling manipulation of application configuration. With a CVSS score of 7.3 (HIGH), a publicly disclosed exploit, and no CISA KEV listing, this vulnerability presents a high operational risk for internet-exposed Krayin deployments.

Technical Analysis

The vulnerability resides in the CanInstall.php middleware, which governs access to the installation/configuration setup API endpoint. The CWE classification is CWE-285, "Improper Authorization," indicating that the middleware fails to correctly enforce authorization checks before allowing access to the protected setup functionality. In Laravel-based applications, middleware typically gates route access; a flaw here means the authorization decision (e.g., checking whether the application is already installed or whether the requester has privilege) is either incorrectly evaluated or bypassable.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L reveals: the attack is network-reachable, requires no privileges or user interaction, needs low complexity, and yields low confidentiality, integrity, and availability impact. This profile is consistent with an attacker reaching a setup/configuration endpoint that should have been gated, and manipulating configuration state.

The NVD description explicitly notes the flaw is "authorization bypass" reachable "remotely" with a public exploit. Upgrading to 2.2.5 mitigates the issue; the fix is associated with commit 89f2916b6a46ff91bd1999ce38158fa0de8b9490. No public Nuclei template, exploit code artifact, or CISA KEV entry was provided.

Insufficient technical detail is available to describe the exact conditional logic in CanInstall.php (e.g., the precise comparison or state check that is bypassed); the analysis is therefore constrained to the vulnerability class — improper enforcement of authorization in install/setup middleware — without fabricating implementation specifics.

Exploitation Scenarios

No public PoC is referenced in the supplied data, though the NVD entry states the exploit "has been made public and could be used." The attack chain is inferred at the vulnerability-class level:

1. Reconnaissance/target identification: The attacker identifies an internet-exposed Krayin laravel-crm instance running version <= 2.2.4, using Shodan-style searches for Krayin/Webkul HTTP signatures and default application titles.

2. Triggering the flaw: Because the CanInstall.php middleware improperly enforces authorization (CWE-285), the attacker sends a crafted network request to the admin-config-setup API endpoint without valid credentials or installer state, bypassing the intended gate. No user interaction or prior authentication is required per the CVSS vector.

3. Execution method (class-level): The bypass allows reaching setup/configuration functionality that should be restricted. The attacker can thereby manipulate application configuration state through the exposed endpoint. No specific parameter names or payloads are documented in the provided data, so no such details are asserted.

4. Post-exploitation impact: With low integrity impact, the attacker may alter configuration to weaken security posture, potentially enabling follow-on abuse. The low confidentiality and availability subscores indicate limited but non-trivial exposure — e.g., disclosure of setup-related information or minor service disruption.

Impact Assessment

Business impact centers on unauthorized configuration manipulation of a CRM platform that may hold customer, sales, and lead data. Affected systems are Krayin laravel-crm deployments at version 2.2.4 or earlier that expose the admin-config-setup endpoint to untrusted networks.

CVSS subscores: Confidentiality Low (C:L), Integrity Low (I:L), Availability Low (A:L), Scope Unchanged (S:U). The high base score (7.3) is driven by the network attack vector, low attack complexity, and the absence of required privileges or user interaction. Blast radius is bounded by the low subscore impacts but is amplified by the fact that no authentication is needed and an exploit is public — meaning mass scanning and opportunistic exploitation are plausible.

Detection Guidance

Sigma Rule

title: Krayin laravel-crm CanInstall Middleware Authorization Bypass (CVE-2026-100885)
id: 8f3c1a52-7b2e-4d19-9a44-cve2026100885
status: experimental
description: Detects unauthorized access attempts to the Krayin admin-config-setup API endpoint bypassing CanInstall middleware authorization.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100885
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/install'
      - '/admin-config-setup'
      - 'CanInstall'
  selection_status:
    sc-status:
      - 200
      - 302
  condition: selection_path and selection_status
falsepositives:
  - Legitimate initial installation by administrators
level: high

YARA Rule

rule CVE_2026_100885_Krayin_CanInstall_AuthBypass
{
    meta:
        description = "Detects Krayin laravel-crm CanInstall middleware authorization bypass artifacts in web logs or responses"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100885"
        cve = "CVE-2026-100885"
        author = "Threat Intelligence"
    strings:
        $a = "CanInstall"
        $b = "packages/Webkul/Installer"
        $c = "admin-config-setup"
        $d = "Krayin" nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100885 Krayin laravel-crm CanInstall Authorization Bypass Attempt"; flow:established,to_server; http.uri; content:"/install"; http.uri; content:"admin-config-setup"; http.method; content:"GET" or content:"POST"; classtype:attempted-admin; sid:2026100885; rev:1;)

Elastic Detection

network where
  http.request.method in ("GET", "POST") and
  (
    stringContains(http.request.uri, "/install") or
    stringContains(http.request.uri, "admin-config-setup")
  ) and
  http.response.status_code in (200, 302)

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| search uri_path IN ("*install*", "*admin-config-setup*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, status
| where status IN (200, 302)
| sort - count

Wazuh OSSEC Rule

<group name="web,krayin,cve-2026-100885,">
  <rule id="2026101" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/install|/admin-config-setup</url>
    <match>200|302</match>
    <description>CVE-2026-100885: Possible Krayin laravel-crm CanInstall middleware authorization bypass access</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict network access to the admin-config-setup and install endpoints using a reverse proxy, WAF, or firewall allow-list so only trusted administrative networks can reach them. If installation is already complete, block the installer routes entirely at the edge. Disable or remove public exposure of any setup/configuration endpoints.

2. Patch/upgrade steps: Upgrade Krayin laravel-crm to version 2.2.5, which resolves the issue. The fix corresponds to patch commit 89f2916b6a46ff91bd1999ce38158fa0de8b9490. Verify the deployed version post-upgrade.

3. Long-term hardening: Enforce defense-in-depth authorization checks at both middleware and controller layers; adopt automated dependency and version monitoring to track CRM releases; run routine external attack-surface scans; and log/monitor all access to setup and configuration routes.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-100885
• Krayin laravel-crm project repository (patch commit 89f2916b6a46ff91bd1999ce38158fa0de8b9490)
• CWE-285: Improper Authorization — https://cwe.mitre.org/data/definitions/285.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-100885 not listed as of reporting)