Is CVE-2026-54180 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54180 being exploited in the wild.

How severe is CVE-2026-54180?

High severity, with a CVSS score of 7.6, published 14 September 2026.

Which products and versions are affected?

backpack/crud (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.8.14.

Is there a fix for CVE-2026-54180?

Yes. backpack/crud (Packagist): upgrade to 6.8.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54180 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54180?

Check whether you run backpack/crud (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54180: Laravel Backpack CRUD authorization bypass in write operations

CVE-2026-54180 · Severity: high · CVSS 7.6 · Published 2026-09-14

Laravel Backpack CRUD is an admin panel builder used to manage database records in Laravel applications. The vulnerability allows authenticated users to update, delete, or reorder records they should not have access to—such as data belonging to other tenants or users—by guessing or knowing a record's ID. This could lead to unauthorized data modification, deletion, or exposure of sensitive information across tenant boundaries in multi-tenant applications.

Technologies: backpack/crud (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-54180 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54180 being exploited in the wild.
How severe is CVE-2026-54180?: High severity, with a CVSS score of 7.6, published 14 September 2026.
Which products and versions are affected?: backpack/crud (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.8.14.
Is there a fix for CVE-2026-54180?: Yes. backpack/crud (Packagist): upgrade to 6.8.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54180 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54180?: Check whether you run backpack/crud (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

backpack/crud (Packagist): upgrade to 6.8.14 or later
```
composer require backpack/crud:^6.8.14
```

Technical details

The vulnerability is an Indirect Object Reference (IDOR) and authorization bypass affecting the CRUD write paths. Backpack CRUD uses `addClause()` and `addBaseClause()` to register query scopes for multi-tenancy and per-user data isolation, which are correctly enforced on list and read operations. However, the Update, Delete, and Reorder endpoints fetch records directly from an unscoped model query, bypassing these restrictions entirely. An authenticated user with knowledge of a record's primary key can therefore modify, delete, or reorder any record in the database that should be invisible to them. The attack requires authentication but no additional user interaction. Patches are available: v6.8.14+ and v7.0.38+ apply scopes consistently across all CRUD operations.

Affected products

Laravel Backpack CRUD 6.0.0 to <6.8.14, 7.0.0 to <7.0.38

Identifiers

CVE-2026-54180
GHSA-vgmv-8xjc-6rch

Timeline

2026-06-15: disclosed: Published to GitHub Advisory Database
2026-08-20: patched: Fixed versions 6.8.14 and 7.0.38 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.