https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-38532.htmlhttps://patchthecve.com/cve/CVE-2026-38532.htmlWed, 17 Jun 2026 10:41:43 +0000HIGH 8.1: A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request.https://patchthecve.com/cve/CVE-2026-38530.htmlhttps://patchthecve.com/cve/CVE-2026-38530.htmlWed, 17 Jun 2026 10:41:42 +0000HIGH 8.1: A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.https://patchthecve.com/cve/CVE-2026-38529.htmlhttps://patchthecve.com/cve/CVE-2026-38529.htmlWed, 17 Jun 2026 10:41:42 +0000HIGH 8.8: A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.