{"id":"CVE-2026-54180","aliases":["GHSA-vgmv-8xjc-6rch"],"url":"https://o3.security/vulnerability/CVE-2026-54180","summary":"backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)","details":"## Summary\n\nBackpack CRUD's list and read operations correctly apply any query scopes\nregistered via `addClause()` / `addBaseClause()` (e.g. tenant isolation, user\nownership). However, the **Update**, **Delete**, and **Reorder** operations\nbypassed these scopes, fetching records directly from the unscoped model query.\n\nAn authenticated user who knows or can guess a record's primary key could\ntherefore update, delete, or reorder records that should be invisible to them —\na classic IDOR on write paths.\n\nApplications that rely on `addBaseClause` for row-level access control\n(multi-tenancy, per-user data isolation) are affected.\n\n## Impact\n\nAny Backpack CRUD panel that uses `addBaseClause` or `addClause` to restrict\nwhich rows a user may access is affected on its write operations.\nAn authenticated low-privilege user can modify or delete records belonging to\nother tenants / users.\n\n## Patches\n\nApply the fixed release for your major version:\n\n- **v6**: upgrade to **6.8.14** or later\n- **v7**: upgrade to **7.0.38** or later\n\nThe fix ensures Update, Delete, and Reorder all resolve records through the same\nscoped query used by the read side.\n\n## Workarounds\n\nIf you cannot upgrade immediately, add explicit `Gate` / `Policy` checks in your\n`CrudController`'s `update()`, `destroy()`, and `reorder()` methods to verify\nthe authenticated user is permitted to act on the resolved record.\n\n## Credits\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304)).","published":"2026-09-14T17:52:19.185Z","modified":"2026-10-02T03:30:33.245520017Z","cvss":{"score":7.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L"},"epss":{"score":0.00329,"percentile":0.26127,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"backpack/crud","fixedVersion":"6.8.14"},{"ecosystem":"Packagist","name":"backpack/crud","fixedVersion":"7.0.38"}],"fix":{"url":"https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969","label":"Laravel-Backpack/CRUD@76c3a6e"},"references":[{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"},{"type":"WEB","url":"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54180.json"},{"type":"ADVISORY","url":"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-vgmv-8xjc-6rch"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54180"},{"type":"FIX","url":"https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969"},{"type":"FIX","url":"https://github.com/Laravel-Backpack/CRUD/commit/dd25c2086b8ea2cb765993b65876c66ab824eef0"},{"type":"FIX","url":"https://github.com/Laravel-Backpack/CRUD/pull/5991"},{"type":"FIX","url":"https://github.com/Laravel-Backpack/CRUD/pull/5994"},{"type":"PACKAGE","url":"https://github.com/Laravel-Backpack/CRUD"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-02T03:30:33.245520017Z"}}