## Summary
Krayin CRM 2.2.3 contains an insecure direct object reference (IDOR) vulnerability (CWE-639) affecting LeadController, PersonController, OrganizationController, QuoteController, and ActivityController. Authenticated users can edit, update, or delete records owned by other users due to missing record-level ownership validation in controller methods.
## Technical Details
The application uses a custom Webkul Admin middleware Webkul\Admin\Http\Middleware\Bouncer to enforce per-route-name ACL, but it does not apply record-level scoping to queries.
Record-level ownership is intended to be enforced via a helper bouncer()->getAuthorizedUserIds() (from packages/Webkul/Admin/src/Bouncer.php). The helper returns:
- null for global view permission
- group user-ids for group scope
- [currentUserId] for individual scope
While listing/view methods correctly apply this helper, the edit/update/delete paths do not. In LeadController, the view($id) method checks ownership before rendering, but edit($id) does not perform the same ownership validation (the reference explicitly notes edit($id) has no ownership check).
Because update endpoints accept attributes such as user_id, attackers can not only modify record contents but also reassign ownership by submitting user_id during update flows (notably via updateAttributes).
## Affected
- Krayin CRM 2.2.3
- Controllers:
- LeadController
- PersonController
- OrganizationController
- QuoteController
- ActivityController
- Affected methods (as reported): edit, update, updateAttributes, updateStage, destroy (and adjacent methods)
## Impact
- Authenticated IDOR enabling cross-user record modification
- Unauthorized edit/update/delete of records owned by other users
- Ownership reassignment by exploiting missing record-level ownership validation (e.g., via user_id on updateAttributes)
## Mitigation
1. Patch/upgrade Krayin CRM to a version where controller methods enforce record-level ownership checks for the affected controllers and methods.
2. Add/restore ownership validation in each affected controller method using bouncer()->getAuthorizedUserIds() before allowing edit, update, updateAttributes, updateStage, and destroy.
3. Ensure update handlers validate that submitted ownership fields (e.g., user_id) cannot be used to reassign ownership unless the current user is authorized for the target record.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-639