CVE-2026-111349 [MEDIUM] – Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator’s CRM.