CVE-2026-90944

Krayin CRM through version 2.2.6 fails to enforce authentication on the POST /admin/mail/inbound-parse endpoint, which is intended to receive inbound mail for the CRM. An unauthenticated remote attacker can POST a crafted RFC 2822 message with forged sender addresses and headers, injecting arbitrary emails into the CRM's inbox — including messages that appear as replies to existing conversation threads. This enables spoofed communications, thread hijacking, and social engineering against sales and support teams who trust the inbox contents, with high impact to integrity (CVSS 4.0: 8.8). Any organization self-hosting Krayin CRM up to and including 2.2.6 with the endpoint reachable is affected. No public proof of concept is known and the flaw is not on the CISA KEV catalog, so exploitation status is currently none known.

What to do: Upgrade Krayin CRM beyond 2.2.6 once Webkul ships a fixed release, and check their advisories for the patch. Until then, block or restrict unauthenticated access to POST /admin/mail/inbound-parse at the reverse proxy or WAF, and require the endpoint to be reachable only from your inbound-mail provider's IPs. Audit CRM inboxes for injected or forged messages and brief staff that inbox contents may not be authentic.