7.0
CVSS 4.0
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, с администраторски права и без действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.
Засегнати продукти
- venturedrake laravel-crm: преди 2.4.0
Вид слабост
История
- 14 октомври 2026 Публикувано
Други уязвимости в venturedrake laravel-crm
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-110630
- https://nvd.nist.gov/vuln/detail/CVE-2026-110630
- https://github.com/venturedrake/laravel-crm/issues/79
- https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Http/Controllers/UserController.php#L87-L94
- https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Livewire/Users/UserIndex.php#L83-L90
- https://github.com/venturedrake/laravel-crm/commit/d64b59fb9f7355e1be9951fbcc5f54ed715dc212
- https://github.com/venturedrake/laravel-crm/commit/27bd5081004913660ccb3e0181b351a2e4ded104
- https://github.com/venturedrake/laravel-crm/releases/tag/2.4.0
- https://github.com/venturedrake/laravel-crm
- https://www.vulncheck.com/advisories/venturedrake-laravel-crm-before-2.4.0-privilege-escalation-via-unscoped-role-assignment