Description

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-14T18:20:28.877Z",
  "pubdate": "2026-09-14T18:20:28.877Z",
  "executiveSummary": "Krayin CRM versions through 2.2.6 are susceptible to an unauthenticated email injection vulnerability residing within the inbound mail parsing functionality.\nThe vulnerability allows remote, unauthenticated attackers to transmit arbitrary RFC 2822-compliant email messages directly into the application's processing queue via the POST /admin/mail/inbound-parse endpoint.\nBy bypassing standard authentication mechanisms, an attacker can forge sender information, modify message headers, and construct arbitrary email bodies.\nThis flaw effectively permits the unauthorized injection of communications into existing conversation threads, potentially leading to social engineering, phishing, or the manipulation of CRM records.\nThe risk is critical due to the lack of access controls on a sensitive entry point that serves as a bridge between external email traffic and internal system data.\nExploitation requires no prior system access, enabling any network-adjacent or external actor to interact with the vulnerable endpoint and influence the state of the CRM inbox.",
  "technicalDetails": "The vulnerability is situated in the application's inbound email processing logic, specifically exposed via the POST /admin/mail/inbound-parse endpoint. The root cause is a complete lack of authentication or authorization checks on this route, which is intended to process incoming emails but fails to verify the source or identity of the requester.\nThe vulnerable component handles raw RFC 2822 message payloads. Because the endpoint does not require valid session tokens or cryptographic verification of the incoming mail stream, it treats any HTTP POST request containing email data as legitimate input. This behavior allows an attacker to interact directly with the backend parsing engine.\nThe attack flow follows a straightforward progression: First, the attacker identifies the target endpoint, /admin/mail/inbound-parse. Second, the attacker crafts a malicious payload formatted according to the RFC 2822 standard. This payload contains manipulated headers, including the 'From', 'To', 'Subject', and 'Message-ID' fields. Third, the attacker transmits this crafted payload to the vulnerable endpoint via an HTTP POST request. Fourth, the Krayin CRM application receives the request, parses the malformed data, and treats it as a legitimate inbound communication. Finally, the application inserts the forged content into the CRM database, potentially attaching it to existing ticket threads or conversation histories.\nFrom a post-exploitation perspective, the impact is significant. By forging the 'From' address, an attacker can impersonate trusted contacts or internal users, facilitating sophisticated social engineering campaigns. The ability to inject replies into existing conversation threads allows attackers to maintain context in ongoing business discussions, effectively deceiving CRM users by introducing malicious links or fraudulent instructions within established message chains. The integrity of the CRM's communication logs is fundamentally compromised, rendering the inbound mail system unreliable for auditing and legitimate customer support operations."
}