CVE-2026-90944

Executive Summary

CVE-2026-90944 is a missing-authentication vulnerability in Krayin CRM through version 2.2.6 that exposes the POST /admin/mail/inbound-parse endpoint to unauthenticated users. Affected organizations run this open-source CRM and have the inbound mail parsing endpoint reachable, allowing any internet attacker to inject arbitrary, forged RFC 2822 emails into the CRM inbox. The impact is high for integrity (injection of arbitrary messages, including forged replies appended to existing threads) with low availability impact (CVSS 8.2), enabling data poisoning, phishing, and social-engineering-oriented abuse of internal CRM records.

Technical Analysis

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function). The Krayin CRM application exposes the route POST /admin/mail/inbound-parse — a function normally intended to ingest inbound email (typically produced by an external mail transport agent, webhook, or mail parser) — without enforcing any authentication or authorization check. In the vulnerable range (through 2.2.6), the endpoint is reachable by an unauthenticated HTTP client, meaning no session cookie, API token, or other credential is validated prior to the application processing the request body.

Because the endpoint is designed to "parse inbound" mail, an attacker can directly supply the email content. The NVD description confirms that arbitrary RFC 2822 messages can be submitted, with attacker-controlled sender information and headers, resulting in email records being written into the CRM inbox. The attacker controls the subject and body content, and may craft messages that appear to be replies to existing conversation threads. This is a pure server-side request-processing flaw: no authentication is performed, and the application trusts the supplied message content to populate the CRM's mail store.

Key technical constraints derived strictly from the provided data:

• The endpoint is an administrative-path route (/admin/mail/...) yet lacks access control — the "admin" path prefix does not imply enforcement.
• The attack surface is any deployment where the Krayin web application is reachable from an untrusted network.
• No public proof-of-concept, Nuclei template, or exploit code is available as of writing, so exploitation behavior described here is inferred at the vulnerability-class level (missing authentication in front of a message-ingestion function).

No specific internal function names, class names, or parameters beyond the documented endpoint have been confirmed in the source data; those must not be assumed. Note that "mail/inbound-parse" strongly implies an inbound mail webhook/parser pattern, but the exact request schema is not specified in the available intelligence and is therefore not asserted here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (missing authentication on an inbound-mail ingestion endpoint) and the NVD description.

1. Reconnaissance / target identification. An attacker enumerates internet-facing hosts and identifies Krayin CRM instances. Identification may leverage distinctive application paths (e.g., the admin interface and mail routes), page titles, or the krayin signature in HTML/JS assets. Shodan-class queries such as http.title:"Krayin" or http.html:"/admin/mail/inbound-parse" narrow candidates. Because the route is under /admin/, the attacker knows the mail-parsing endpoint likely exists once a Krayin instance is confirmed.

2. Triggering the flaw class. With the instance identified, the attacker sends an unauthenticated POST request to /admin/mail/inbound-parse. No credential acquisition or session establishment is required — this is the core of the CWE-306 flaw. The application processes the request without rejecting it for lack of authentication.

3. Payload/execution method at the class level. The request body contains an RFC 2822 message composed by the attacker. The attacker forges the From sender information and other headers, and chooses the subject and body. Because the endpoint performs inbound parsing, the attacker-supplied message is accepted and persisted as an email record in the CRM inbox. The attacker can also craft the message to mimic a reply within an existing conversation thread, causing the forged content to appear as part of an established thread inside the CRM. Other email header values can be set by the attacker to shape how the message appears to CRM operators.

4. Post-exploitation impact. Injected emails persist in the CRM inbox and can be viewed by CRM users and agents. This enables:

   • Data poisoning / integrity loss — the CRM's mail history no longer reliably reflects genuine customer communications.
   • Social engineering and phishing — forged inbound messages appear to originate from legitimate senders, potentially inducing staff to act on malicious links, attachments, or instructions contained in the message body.
   • Thread hijacking — fabricated replies attach to real conversations, increasing the credibility of the injected content.
   • Downstream process abuse — if CRM workflows, automations, or ticket/mail integrations act on inbox content, injected messages may trigger unintended processing or notifications. Availability impact is limited (the system continues operating); confidentiality impact is none per the CVSS vector; integrity impact is High.

Impact Assessment

• CVSS: 8.2 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L.
  • AV:N (Network) — exploitable remotely over the network.
  • AC:L (Low) — no special conditions beyond reaching the endpoint.
  • PR:N (None) — no privileges required; this is the defining characteristic (missing authentication).
  • UI:N (None) — no user interaction needed for the injection itself.
  • S:U (Unchanged) — impact confined to the Krayin application.
  • C:N (None) — no confidentiality impact reported.
  • I:H (High) — arbitrary, unauthenticated modification of CRM inbox content.
  • A:L (Low) — limited availability impact; the environment remains operational.
• Affected systems: Krayin CRM deployments up to and including 2.2.6 where /admin/mail/inbound-parse is exposed to untrusted networks.
• Blast radius: Any organization relying on Krayin as a system of record for customer/email communications. Injected content can propagate to CRM users, reporting, and any integrations consuming inbox data.
• Business risk: Integrity compromise of a trusted internal system undermines its evidentiary value, facilitates internal phishing, and may lead to fraudulent action based on forged communications. Exploitability is trivial (no credentials, low complexity), although EPSS is low at 0.00660 (49.4th percentile), suggesting observed exploitation is currently unlikely.
• Not in CISA KEV; no known exploit-in-the-wild evidence provided.

Detection Guidance

Detection focuses on identifying unauthenticated POSTs to /admin/mail/inbound-parse, especially requests lacking session cookies/API tokens and containing email message content.

Sigma Rule

title: Unauthenticated POST to Krayin CRM Inbound-Parse Endpoint
id: 6a2f1c9e-3b7d-4f21-9c88-krayin90944
status: experimental
description: Detects requests to the Krayin CRM mail inbound-parse endpoint without authentication, indicative of CVE-2026-90944 email injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90944
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains: '/admin/mail/inbound-parse'
  filter_authenticated:
    cs-cookie|contains:
      - 'laravel_session'
      - 'XSRF-TOKEN'
      - 'krayin_session'
  condition: selection_method and selection_uri and not filter_authenticated
falsepositives:
  - Legitimate mail ingestion from a trusted MTA/webhook (should originate from known mail infrastructure)
level: high
tags:
  - attack.t1190
  - cve.2026.90944

YARA Rule

rule CVE_2026_90944_Krayin_InboundParse_Injection
{
    meta:
        author = "valtersit.com"
        description = "Detects HTTP requests targeting Krayin CRM inbound-parse endpoint (CVE-2026-90944)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90944"
        date = "2026-01-01"
    strings:
        $endpoint = "/admin/mail/inbound-parse" ascii nocase wide
        $m1 = "POST /admin/mail/inbound-parse" ascii nocase
        $m2 = "inbound-parse" ascii nocase
        $rfc = "From:" ascii nocase
        $rfc2 = "Subject:" ascii nocase
    condition:
        ($endpoint or $m1 or $m2) and ($rfc or $rfc2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90944 Krayin CRM unauthenticated inbound-parse injection attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/admin/mail/inbound-parse"; nocase; http.header; content:"!Cookie"; nocase; http.request_body; content:"From:"; nocase; reference:cve,2026-90944; classtype:web-application-attack; sid:9094401; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where http.request.method == "POST" and url.path == "/admin/mail/inbound-parse"]

Splunk SPL Query

index=web sourcetype=access_combined
uri_path="/admin/mail/inbound-parse" method=POST
| eval authenticated=if(match(cookie,"laravel_session|XSRF-TOKEN|krayin_session"),"yes","no")
| where authenticated="no"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips values(useragent) as user_agents by uri_path authenticated
| sort - count

Wazuh OSSEC Rule

<group name="web,krayin,cve_2026_90944">
  <rule id="909440" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>/admin/mail/inbound-parse</match>
    <regex>POST\s+/admin/mail/inbound-parse</regex>
    <description>CVE-2026-90944: Unauthenticated POST to Krayin CRM inbound-parse endpoint - possible email injection.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source, OSV, indicates a patch exists, but this is not independently confirmed and no patched version number or vendor advisory is available). OSV data lists the package as 0 → unfixed, so no confirmed fixed release can be cited.

1. Immediate mitigations (compensating controls):

   • Block external access to /admin/mail/inbound-parse at the reverse proxy, WAF, or load balancer for all sources except known, trusted mail infrastructure (allowlist by source IP). If the endpoint is consumed by an internal MTA/webhook, restrict ingress to that host only.
   • Require authentication on the route if the application or its proxy permits it; where possible, enforce a shared secret/signature that only the legitimate mail sender possesses.
   • Place the entire /admin/ path behind network-level access control (VPN, IP allowlist) and never expose the admin panel directly to the internet.
   • Monitor and alert on any POST to the endpoint lacking a valid session cookie (see Detection Guidance).

2. Patch / upgrade steps:

   • Verify the current Krayin CRM version; if not already on the latest release and an update addressing this endpoint's authentication is published, upgrade to it.
   • Because the patch claim is unconfirmed, validate any new release notes for a fix to the inbound-parse authentication check before relying on it, and retest the endpoint post-upgrade.
   • If no patch is available for your version, apply the compensating controls in step 1 and isolate the application until a fix can be validated.

3. Long-term hardening:

   • Enforce authentication and authorization on every mail-ingestion and administrative endpoint; treat /admin/ routes as requiring authenticated sessions by default.
   • Validate and sanitize inbound message content (sender, headers, subject, body) at the ingestion boundary; never trust externally supplied email metadata.
   • Implement rate limiting and anomaly detection on mail-ingestion endpoints to detect bulk or abnormal injection.
   • Segment CRM/mail infrastructure from untrusted networks and audit inbox integrity regularly.
   • Maintain a vendor patch-watch process and subscribe to Krayin security advisories; track CVE-2026-90944 for a confirmed fixed version.

References

1. NVD — CVE-2026-90944: https://nvd.nist.gov/vuln/detail/CVE-2026-90944
2. MITRE CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. OSV — vulnerability/package records referencing Krayin CRM (single source claiming patch status): https://osv.dev/
5. FIRST EPSS — CVE-2026-90944 score and percentile: https://www.first.org/epss/

No known threat actor campaigns, CISA KEV listing, or confirmed exploit-in-the-wild evidence is associated with CVE-2026-90944 in the provided intelligence. EPSS is 0.00660 (49.4th percentile), and no public PoC, Nuclei template, or exploit code was identified.