CVE-2026-110629: Missing Authorization in venturedrake laravel-crm
Description
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
CVSS v4.0
Score 7.1high
Affected software
venturedrake
laravel-crm
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-110629 describes a missing authorization vulnerability in VentureDrake Laravel CRM prior to version 2.4.0. Authenticated users with read-only roles can bypass Spatie role permissions by invoking Livewire action methods like delete, won, lost, or reopen on components such as DealIndex. Additionally, unguarded Activities and Products routes allow these users to modify deals, quotes, orders, and invoices, leading to unauthorized data manipulation.
Potential Impact
The vulnerability allows authenticated users with read-only permissions to perform unauthorized modifications on critical business data including deals, quotes, orders, and invoices. This bypass of role-based access control can lead to data integrity issues and potential business process disruption.
Mitigation Recommendations
A fix is available in VentureDrake Laravel CRM version 2.4.0. Users should upgrade to version 2.4.0 or later to remediate this missing authorization vulnerability. Until upgraded, restrict access to authenticated users and review role permissions carefully.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-14T13:07:29.774Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acf92f02cdf04f6568a3843
Added to database: 10/14/2026, 14:34:24 UTC
Last enriched: 10/14/2026, 14:49:27 UTC
Last updated: 10/14/2026, 19:00:32 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.