CVE-2026-54180

backpack/crud (v6.0.0–6.8.14, v7.0.38) is a Laravel package for building administration panels. The vulnerability is an insecure direct object reference (IDOR) on write paths : the Update , Delete , and Reorder operations resolved records from the unscoped model query instead of the query configu...

Incorrect Authorization

Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Incorrect Authorization in the Update, Delete, and Reorder processes, where query scopes registered via addClause or...

GHSA-VGMV-8XJC-6RCH Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

Summary Backpack CRUD's list and read operations correctly apply any query scopes registered via addClause / addBaseClause e.g. tenant isolation, user ownership. However, the Update, Delete, and Reorder operations bypassed these scopes, fetching records directly from the unscoped model query. An...