CVE-2026-57570 backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.15 and 7.0.47, HasMany and MorphMany handling through attachManyRelation during CRUD create and update...

CVE-2026-57570

backpack/crud (a Laravel Backpack CRUD package) versions 6.0.0 through 6.8.15 and 7.0.47 contain a Missing Authorization flaw (CWE-862) in how HasMany and MorphMany relationship fields are handled during CRUD create and update operations. The attachManyRelation logic accepted submitted child prim...