CVE-2026-110630

Deferred Deferred - Pending Action

Incorrect Authorization in VentureDrake Laravel CRM Allows Privilege Escalation

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110630

EUVD

EUVD-2026-101258

Affected Vendors & Products

Vendor	Product	Version / Range
venturedrake	laravel-crm	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is a privilege escalation flaw in VentureDrake Laravel CRM versions before 2.4.0. It allows authenticated administrators to assign unrestricted roles, including the Owner role or roles from other teams, by exploiting an unscoped Role::find function. Attackers can also delete users across teams using an unscoped UserIndex::delete() method.

Detection Guidance

To detect this vulnerability, check the Laravel CRM version installed on your system. If it is below 2.4.0, the system is vulnerable. Run: composer show venturedrake/laravel-crm to verify the version. Additionally, review user role assignments and deletions in logs for unauthorized actions.

Impact Analysis

An attacker with user-management access could escalate privileges to Owner, grant themselves or others unrestricted access, and delete users across teams. This could lead to unauthorized data access, data loss, or complete system compromise depending on the CRM's role structure.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data (GDPR Article 32, HIPAA Security Rule). Unrestricted role assignment and user deletion may lead to data breaches, lack of audit trails, and failure to implement proper access controls.

Mitigation Strategies

Immediately upgrade to Laravel CRM version 2.4.0 or later. This version includes fixes for role escalation and user deletion issues. Follow the upgrade instructions in the release notes to ensure proper application of security patches.

Hi! I’m here to help you understand CVE-2026-110630. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70