Krayin - Laravel-crm - CRITICAL - CVE-2026-41452. Krayin CRM version 2.2.4 is susceptible to a vulnerability in its installer middleware that enables unauthorized remote attackers to compromise the primary administrator account. By crafting a specific HTTP POST request with an X-Requested-With: XMLHttpRequest header, attackers can circumvent the CanInstall middleware's checks. This flaw permits unauthorized individuals to submit arbitrary values for account name, email, and password through the admin-config-setup endpoint. The intermediary updateOrInsert method that targets a hardcoded administrator user ID effectively grants complete administrative control over the CRM data. BADGES: 👾 EXPLOITED | 🟡 PoC | SecurityVulnerability.io