CVE-2026-54180: Laravel Backpack CRUD authorization bypass in write operations

Executive brief

Laravel Backpack CRUD is an admin panel builder used to manage database records in Laravel applications. The vulnerability allows authenticated users to update, delete, or reorder records they should not have access to—such as data belonging to other tenants or users—by guessing or knowing a record's ID. This could lead to unauthorized data modification, deletion, or exposure of sensitive information across tenant boundaries in multi-tenant applications.

Technical details

The vulnerability is an Indirect Object Reference (IDOR) and authorization bypass affecting the CRUD write paths. Backpack CRUD uses `addClause()` and `addBaseClause()` to register query scopes for multi-tenancy and per-user data isolation, which are correctly enforced on list and read operations. However, the Update, Delete, and Reorder endpoints fetch records directly from an unscoped model query, bypassing these restrictions entirely. An authenticated user with knowledge of a record's primary key can therefore modify, delete, or reorder any record in the database that should be invisible to them. The attack requires authentication but no additional user interaction. Patches are available: v6.8.14+ and v7.0.38+ apply scopes consistently across all CRUD operations.

Affected products

• Laravel Backpack CRUD 6.0.0 to <6.8.14, 7.0.0 to <7.0.38

Timeline

• 2026-06-15: disclosed: Published to GitHub Advisory Database
• 2026-08-20: patched: Fixed versions 6.8.14 and 7.0.38 released

References

• https://api.github.com/users/tabacitu
• https://github.com/tabacitu
• https://api.github.com/users/tabacitu/gists%7B/gist_id%7D
• https://api.github.com/users/tabacitu/repos
• https://avatars.githubusercontent.com/u/1032474?v=4
• https://api.github.com/users/tabacitu/events%7B/privacy%7D