CVE-2026-54180

Backpack for Laravel's CRUD package (backpack/crud) resolves records for the Update, Delete, and Reorder operations from the unscoped model query rather than the scoped query defined via addClause() or addBaseClause(), which is what the List and Read operations use. An authenticated admin-panel user who knows or guesses an out-of-scope record's primary key can send a crafted write request to modify, delete, or reorder records that should be hidden from them by tenant isolation, ownership, or other row-level access-control scopes. The attacker gains unauthorized write access (and some information exposure via record IDs) across tenant or ownership boundaries, but applications that do not use CRUD query clauses for authorization are not affected by this specific bypass. Affected versions are 6.0.0 up to (but not including) 6.8.14, and 7.0.0 up to (but not including) 7.0.38; the fix routes all three write operations through getModelWithCrudPanelQuery(). No public proof of concept exists, the flaw is not in the CISA KEV catalog, and no exploitation has been reported.

What to do: Upgrade backpack/crud to 6.8.14 (6.x line) or 7.0.38 (7.x line) or later, which routes Update, Delete, and Reorder through the scoped query. If immediate upgrade is not possible, add explicit authorization/policy checks (or global scopes) on the models used by affected CRUD controllers so write operations cannot touch out-of-scope primary keys. Audit application and server logs for authenticated users issuing update/delete/reorder requests against record IDs outside their tenant or ownership scope.