Authorization Bypass in Backpack CRUD for Laravel Packages
CVE-2026-54180
7.6HIGH
What is CVE-2026-54180?
A vulnerability in Backpack CRUD for Laravel allows authenticated users to bypass access controls. Specifically, the Update, Delete, and Reorder operations improperly resolve records, enabling unauthorized modifications to be made to out-of-scope records. This occurs due to an issue where the operations do not adhere to the configured query scopes. The vulnerability impacts versions from 6.0.0 until 6.8.14 and 7.0.38. The issue has been addressed in later versions, ensuring that all write operations align with the intended access controls.
Affected Version(s)
CRUD >= 6.0.0, < 6.8.14 < 6.0.0, 6.8.14
CRUD >= 7.0.0, < 7.0.38 < 7.0.0, 7.0.38