medium6.5
CVE-2026-110630
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign u…
Impact
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.
Affected products
| Product | Affected versions |
|---|---|
| VentureDrake Laravel CRM | before 2.4.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/venturedrake/laravel-crm
- https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Http/Controllers/UserController.php#L87-L94
- https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Livewire/Users/UserIndex.php#L83-L90
- https://github.com/venturedrake/laravel-crm/commit/27bd5081004913660ccb3e0181b351a2e4ded104
- https://github.com/venturedrake/laravel-crm/commit/d64b59fb9f7355e1be9951fbcc5f54ed715dc212
- https://github.com/venturedrake/laravel-crm/issues/79
- https://github.com/venturedrake/laravel-crm/releases/tag/2.4.0
- https://www.vulncheck.com/advisories/venturedrake-laravel-crm-before-2.4.0-privilege-escalation-via-unscoped-role-assignment