CVE-2026-110630: Incorrect Authorization in venturedrake laravel-crm

CVE-2026-110630 describes an incorrect authorization vulnerability in VentureDrake Laravel CRM prior to version 2.4.0. The flaw exists in the user management component where authenticated administrators can misuse Role::find to assign unrestricted roles, such as the Owner role or roles belonging to other teams. Additionally, the unscoped UserIndex delete() method permits deletion of users across different teams. This improper authorization enables privilege escalation and unauthorized user deletions within the application.

An attacker with authenticated administrator-level access to user management can escalate privileges by assigning themselves or others the Owner role or roles from other teams. They can also delete users across teams without restriction. This can lead to unauthorized access, privilege escalation, and disruption of user accounts within the CRM system.

Upgrade VentureDrake Laravel CRM to version 2.4.0 or later, where this authorization vulnerability has been fixed. No other mitigation guidance is provided, so applying the official fix is the recommended action.