Administrator escalation via unchecked role assignment

Improper authorization in Bagisto Krayin CRM 2.2.0 through 2.2.5 allows remote authenticated users to gain Administrator access. UserController::store() and update() accept a client-supplied role_id, check only that the role exists, and mass-assign it without verifying that the acting user may grant that role. An account with delegated user-create or user-edit permission can promote itself or another account and gain control of CRM users, settings, and stored customer data.