CVE-2026-100884

A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource identifiers. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.2.6 is sufficient to resolve this issue. The identifier of the patch is 13d6988cda8d69ece45ee1890effc90a7f21cdc1. It is suggested to upgrade the affected component.

• CWE-99

• https://github.com/carlosalbertotuma/advisory/blob/main/advisory-06-IDOR-Email-Attachment%20Download.md
• https://github.com/krayin/laravel-crm/
• https://github.com/krayin/laravel-crm/commit/13d6988cda8d69ece45ee1890effc90a7f21cdc1
• https://github.com/krayin/laravel-crm/issues/2624
• https://github.com/krayin/laravel-crm/pull/2627
• https://github.com/krayin/laravel-crm/releases/tag/v2.2.6
• https://vuldb.com/cve/CVE-2026-100884
• https://vuldb.com/submit/916218
• https://vuldb.com/vuln/410814
• https://vuldb.com/vuln/410814/cti

Published

Sep 27, 2026

Last Modified

Sep 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100878A vulnerability was identified in zhistaredu StarTraining up…6.3
• CVE-2026-100879A security flaw has been discovered in zhistaredu StarTraini…4.3
• CVE-2026-100880A weakness has been identified in zhistaredu StarTraining up…3.5
• CVE-2026-100881A security vulnerability has been detected in zhistaredu Sta…2.6
• CVE-2026-100882A vulnerability was detected in Krayin laravel-crm up to 2.2…2.4
• CVE-2026-100883A flaw has been found in Krayin laravel-crm up to 2.2.5. The…6.3
• CVE-2026-100885A vulnerability was found in Krayin laravel-crm up to 2.2.4.…7.3
• CVE-2026-100886A vulnerability was identified in Seetong T8108, T8108P, T81…10
• CVE-2026-100887A security flaw has been discovered in amirsanni Mini-Invent…6.3
• CVE-2026-100888A weakness has been identified in Trusted Domain Project Ope…7.3
• CVE-2026-100889A vulnerability was detected in Trusted Domain Project OpenD…7.3
• CVE-2026-10089The Insert Pages plugin for WordPress is vulnerable to Store…6.4