The vulnerability in Laravel-Backpack CRUD arises because the Update, Delete, and Reorder operations resolve records from the unscoped model query rather than the scoped query configured through addClause() or addBaseClause(). This allows an authenticated user with knowledge or guess of an out-of-scope record's primary key to perform unauthorized modifications, deletions, or reorderings of records that should be hidden by tenant, ownership, or other row-level access controls. Applications that do not rely on CRUD query clauses for authorization are not affected. The fix ensures these write operations use getModelWithCrudPanelQuery(), aligning with the scoped list and read behavior. The vulnerability is tracked as CVE-2026-54180 and has a CVSS 3.1 score of 7.6 (high severity).

An authenticated user with at least limited privileges can bypass row-level access controls by exploiting this vulnerability, potentially modifying, deleting, or reordering records they should not have access to. This could lead to unauthorized data manipulation within the affected Laravel-Backpack CRUD installations. The confidentiality impact is low, integrity impact is high, and availability impact is low according to the CVSS vector.

Upgrade Laravel-Backpack CRUD to version 6.8.14 or later in the 6.x series, or to version 7.0.38 or later in the 7.x series, where the issue is fixed. No other mitigations are indicated. Applications that do not rely on CRUD query clauses for authorization are not affected by this bypass.