Threat database

VentureDrake Laravel CRM versions prior to 2.4.0 have an incorrect authorization vulnerability in the user management module. Authenticated administrators with user-management access can exploit this flaw to assign unrestricted roles, including the Owner role or roles from other teams. They can also delete users across different teams via an unscoped delete method. This vulnerability allows privilege escalation and unauthorized user management actions.

VentureDrake Laravel CRM versions before 2.4.0 have a missing authorization vulnerability that allows authenticated users with read-only roles to bypass Spatie role permissions. This enables them to invoke sensitive Livewire action methods such as delete, won, lost, or reopen on components like DealIndex, and access unguarded Activities and Products routes to modify deals, quotes, orders, and invoices.