Backpack/CPUD CWE-862 cross-tenant IDOR vulnerability analysis & fix

Key Vulnerability Information Summary Vulnerability Overview Title: HasMany/MorphMany Relation Fields Allow Cross-Tenant Record Re-association (IDOR) via attachManyRelation CVE: CVE-862 Severity Level: Moderate CVSS 3.1: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) CWE: CWE-862 (Missing Authorization) Affected Package: (Composer) Affected Versions: and Fixed Versions: and Root Cause: When processing relation fields in CRUD form submissions, the system failed to sufficiently validate whether the submitted primary keys belong to the current parent model or the relation scope defined by the developer. This allows low-privilege administrators to re-associate, detach, or delete related records across tenants or users. Scope of Impact Affected Scenarios: Handling of HasMany/MorphMany relation fields during CRUD create/update operations. Potential Impacts: - Unauthorized cross-user/parent/tenant reallocation of related records - Unauthorized detachment or deletion of related records - Data integrity issues in multi-tenant or permission-sensitive applications Triggering Conditions (all must be met): - Backpack CRUD forms expose HasMany/MorphMany multi-select relation fields - Related models contain records that the current administrator is not authorized to attach/detach - The application relies on tenant, ownership, or authorization boundaries - The application does not implement additional validation for relation values Remediation Recommended Fixes: - Backpack should restrict relation attach/detach operations to the current parent model and relation context. - Ensure related records are filtered through the relation's restricted query scope, ownership rules, or constraints defined by the developer. - Implement server-side validation for submitted values in relation fields, especially in multi-tenant or permission-sensitive admin panels. Verification: Verified via internal PHPUnit tests: before the fix, related records could be re-associated across parent models; after the fix, submitted values are constrained before modifying related records, preventing unauthorized re-association or deletion. POC/Exploit Code The page does not contain POC code or an exploit code block.

Goal Reached Thanks to every supporter — we hit 100%!

Backpack/CPUD CWE-862 cross-tenant IDOR vulnerability analysis & fix

More from this source