CVE-2026-57570
MEDIUMCVE-2026-57570 is a medium-severity (CVSS 6.5) vulnerability in backpack/crud. O3 Security confirms whether CVE-2026-57570 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
Real-World Exposure
backpack/crud🐘backpack/crudReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Vulnerability Details
Affected area: HasMany / MorphMany relation handling during CRUD create and update operations
CWE: CWE-862 — Missing Authorization
Severity: Medium
CVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Summary
Backpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations.
When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model.
This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field.
Root Cause
The vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope.
As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form.
This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic.
Impact
An authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records.
Possible impact includes:
- Unauthorized reassignment of related records across users, parents, or tenants.
- Unauthorized detachment or removal of related records.
- Data integrity issues in multi-tenant or permission-sensitive applications.
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field.
Affected Conditions
An application may be affected when all of the following are true:
- A Backpack CRUD form exposes a multiple-selection field for a HasMany or MorphMany relation.
- The related model contains records that should not be attachable or removable by the current admin user.
- The application relies on tenant, ownership, or authorization boundaries for those related records.
- The application has not added its own additional validation or authorization checks around submitted relation values.
Recommended Fix
Backpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context.
The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs.
Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels.
Verification
The issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures.
The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check.
After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | backpack/crud | ≥ 7.0.0&&< 7.0.47 | 7.0.47 |
| 🐘Packagist | backpack/crud | ≥ 6.0.0&&< 6.8.15 | 6.8.15 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for backpack/crud. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update backpack/crud to 7.0.47 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-57570 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-57570 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-57570. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-57570 in your dependencies?
O3 detects CVE-2026-57570 across Packagist dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.