CVE-2026-57570 backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.15 and 7.0.47, HasMany and MorphMany handling through attachManyRelation during CRUD create and update...

PT-2026-80779

Vulnerability Details Affected area: HasMany / MorphMany relation handling during CRUD create and update operations CWE: CWE-862 — Missing Authorization Severity: Medium CVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Summary Backpack CRUD contained an authorization issue in the way...