CVE-2026-57570: CWE-862: Missing Authorization in Laravel-Backpack CRUD
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.15 and 7.0.47, HasMany and MorphMany handling through attachManyRelation during CRUD create and update operations accepts submitted child primary keys without consistently restricting updates to records belonging to the current parent or permitted by the developer-defined relation scope. An authenticated low-privilege administrator who can edit a parent form exposing an affected multiple-relation field can cause unrelated child records to be reassigned, detached, nulled, or deleted across ownership or tenant boundaries. Exploitation requires related records that should not be attachable or removable by that administrator and the absence of additional application-level authorization around submitted relation values. This issue is distinct from earlier direct main-entity CRUD scoping fixes because it affects secondary models modified by relationship-saving logic. This issue is fixed in versions 6.8.15 and 7.0.47.
AI Analysis
Technical Summary
The vulnerability in Laravel-Backpack CRUD involves insufficient authorization checks when processing HasMany and MorphMany relationships via the attachManyRelation method during CRUD create and update operations. Specifically, child primary keys submitted by a low-privilege authenticated administrator are accepted without consistent restrictions ensuring they belong to the current parent or are permitted by the developer-defined relation scope. This flaw allows unauthorized modification of secondary models related to the parent entity, such as reassigning or deleting child records across ownership or tenant boundaries. Exploitation requires that related records exist which should not be attachable or removable by the attacker and that no additional application-level authorization is implemented around the submitted relation values. This vulnerability is distinct from prior fixes addressing main-entity CRUD scoping and was resolved in versions 6.8.15 and 7.0.47.
Potential Impact
An authenticated low-privilege administrator can exploit this vulnerability to cause unauthorized changes to child records related to a parent entity, including reassigning, detaching, nullifying, or deleting these records across ownership or tenant boundaries. This can lead to integrity issues in data management within multi-tenant or ownership-segregated environments. The vulnerability does not impact confidentiality or availability directly but has a high impact on data integrity.
Mitigation Recommendations
This vulnerability is fixed in Laravel-Backpack CRUD versions 6.8.15 and 7.0.47. Users should upgrade to these or later versions to remediate the issue. Additionally, ensure that application-level authorization checks are implemented around submitted relation values to prevent unauthorized modifications. No other specific mitigations are indicated.
CVE-2026-57570: CWE-862: Missing Authorization in Laravel-Backpack CRUD
Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.15 and 7.0.47, HasMany and MorphMany handling through attachManyRelation during CRUD create and update operations accepts submitted child primary keys without consistently restricting updates to records belonging to the current parent or permitted by the developer-defined relation scope. An authenticated low-privilege administrator who can edit a parent form exposing an affected multiple-relation field can cause unrelated child records to be reassigned, detached, nulled, or deleted across ownership or tenant boundaries. Exploitation requires related records that should not be attachable or removable by that administrator and the absence of additional application-level authorization around submitted relation values. This issue is distinct from earlier direct main-entity CRUD scoping fixes because it affects secondary models modified by relationship-saving logic. This issue is fixed in versions 6.8.15 and 7.0.47.
CVSS v3.1
Score 6.5medium
Affected software
Laravel-Backpack
CRUD
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Laravel-Backpack CRUD involves insufficient authorization checks when processing HasMany and MorphMany relationships via the attachManyRelation method during CRUD create and update operations. Specifically, child primary keys submitted by a low-privilege authenticated administrator are accepted without consistent restrictions ensuring they belong to the current parent or are permitted by the developer-defined relation scope. This flaw allows unauthorized modification of secondary models related to the parent entity, such as reassigning or deleting child records across ownership or tenant boundaries. Exploitation requires that related records exist which should not be attachable or removable by the attacker and that no additional application-level authorization is implemented around the submitted relation values. This vulnerability is distinct from prior fixes addressing main-entity CRUD scoping and was resolved in versions 6.8.15 and 7.0.47.
Potential Impact
An authenticated low-privilege administrator can exploit this vulnerability to cause unauthorized changes to child records related to a parent entity, including reassigning, detaching, nullifying, or deleting these records across ownership or tenant boundaries. This can lead to integrity issues in data management within multi-tenant or ownership-segregated environments. The vulnerability does not impact confidentiality or availability directly but has a high impact on data integrity.
Mitigation Recommendations
This vulnerability is fixed in Laravel-Backpack CRUD versions 6.8.15 and 7.0.47. Users should upgrade to these or later versions to remediate the issue. Additionally, ensure that application-level authorization checks are implemented around submitted relation values to prevent unauthorized modifications. No other specific mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-24T18:49:56.207Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa836a955bf5e2cf5684397
Added to database: 09/14/2026, 18:02:17 UTC
Last enriched: 09/14/2026, 18:17:06 UTC
Last updated: 09/14/2026, 21:06:59 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.