Laravel Backpack CRUD Vulnerability in HasMany and MorphMany Functions
CVE-2026-57570
What is CVE-2026-57570?
A vulnerability in Backpack/CRUD allows an authenticated low-privilege administrator to manipulate child records inappropriately during CRUD operations. Specifically, issues arise during the handling of HasMany and MorphMany relations through attachManyRelation. If proper restrictions are not applied, this vulnerability allows the administrator to reassign, detach, null, or delete child records that do not belong to the designated parent or are not permitted by the developer's relation scope. This highlights serious issues with application-level authorization, accentuating the need for vigilant security measures surrounding user permissions. The problem is remedied in newer releases, urging users to update to versions 6.8.15 or 7.0.47.
Affected Version(s)
CRUD >= 6.0.0, < 6.8.15 < 6.0.0, 6.8.15
CRUD >= 7.0.0, < 7.0.47 < 7.0.0, 7.0.47