CVE-2026-111349

MediumCVSS 5.3

Published: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Summary

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.

Risk Assessment

Unauthenticated attackers can insert fake customer records into the CRM, leading to data pollution and potential fraud.

Recommendation

Update Craftplan to a version later than 0.7.5 if available, or implement authentication and authorization for customer creation endpoints.

Other vulnerabilities in Craftplan

CVE-2026-76876Medium
Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS