CVE-2026-54180— backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
Quick assessment
Affected
Laravel-Backpack CRUD
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
backpack/crud 为 Backpack 提供创建、读取、更新和删除（CRUD）功能。Backpack 是一套帮助用户构建自定义管理后台面板的 Laravel 包集合。 在 6.0.0 至 6.8.14 以及 7.0.38 版本中，Update（更新）、Delete（删除）和 Reorder（重新排序）操作是从未应用作用域限制的模型查询中解析记录，而不是通过 或 配置的查询中解析记录。因此，一个知道或猜出超出作用域范围（如租户、所有权或其他行级访问控制所隐藏的记录）的主键的已认证用户，可以修改、删除或重新排
Possible ATT&CK Techniques 3 AI
T1190 · Exploit Public-Facing Application T1535 · Unused/Unsupported Cloud Regions T1535.005Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Laravel-Backpack | CRUD | >= 6.0.0, < 6.8.14 |
affected |
>= 7.0.0, < 7.0.38 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54180
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
Source: CVE Program / CVE List V5
Vulnerability Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query instead of the query configured through addClause() or addBaseClause(). An authenticated user who knows or guesses an out-of-scope record primary key can therefore modify, delete, or reorder records hidden by tenant, ownership, or other row-level access-control scopes. Applications that do not rely on CRUD query clauses for authorization are not affected by this specific bypass. The fix routes all three write operations through getModelWithCrudPanelQuery(), matching the scoped list and read behavior. This issue is fixed in versions 6.8.14 and 7.0.38.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Laravel-Backpack | CRUD | >= 6.0.0, < 6.8.14 | - |
|
II. Public POCs for CVE-2026-54180
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54180
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54180 (4)
-
-
🔗 fixes by pxpm · Pull Request #5994 · Laravel-Backpack/CRUD x_refsource_MISC
-
-
Vendor Advisories for CVE-2026-54180 (1)
Vendor Pages for CVE-2026-54180 (2)
-
🔗 Release 7.0.38 🌈 · Laravel-Backpack/CRUD · GitHub x_refsource_MISC
-
🔗 Release 6.8.14 🌈 · Laravel-Backpack/CRUD · GitHub x_refsource_MISC
Same Patch Batch · Laravel-Backpack · 2026-09-14 · 8 CVEs total
| CVE-2026-54178 | 8.1 HIGH | backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUpload |
| CVE-2026-54182 | 8.1 HIGH | backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host |
| CVE-2026-54175 | 7.6 HIGH | backpack/crud: Unverified password change in MyAccountController via mass assignment |
| CVE-2026-54177 | 6.6 MEDIUM | backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk up |
| CVE-2026-54176 | 6.5 MEDIUM | backpack/crud: MyAccountController allows changing the login email without a current-passw |
| CVE-2026-57570 | 6.5 MEDIUM | backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (I |
| CVE-2026-54181 | 5.4 MEDIUM | backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are |
IV. Related Vulnerabilities
Same product: CRUD
-
CVE-2026-54181
backpack/crud: Stored XSS in the color column — the `@if($co -
CVE-2026-54177
backpack/crud: HasUploadFields keeps the attacker-supplied f -
CVE-2026-54176
backpack/crud: MyAccountController allows changing the login -
CVE-2026-57570
backpack/crud: HasMany/MorphMany relation fields allow cross -
CVE-2026-54178
backpack/crud: Arbitrary file deletion via attacker-controll
Same vendor: Laravel-Backpack
-
CVE-2026-54181
backpack/crud: Stored XSS in the color column — the `@if($co -
CVE-2026-54177
backpack/crud: HasUploadFields keeps the attacker-supplied f -
CVE-2026-54176
backpack/crud: MyAccountController allows changing the login -
CVE-2026-57570
backpack/crud: HasMany/MorphMany relation fields allow cross -
CVE-2026-54178
backpack/crud: Arbitrary file deletion via attacker-controll
Same weakness: CWE-639
-
CVE-2026-9812
Missing property field ownership validation in Playbooks run -
CVE-2026-10542
Playbooks channel action update validation issue -
CVE-2026-90697
SourceCodester Inventory Management System invoice.php autho -
CVE-2026-90598
jaygajera17 E-commerce-project-springBoot UserController.jav -
CVE-2026-90521
jaychouchannel Tourism-Management-System CRUD Menpiaodingdan
V. Comments for CVE-2026-54180
No comments yet