CVE-2026-54180
Received Received - Intake

Row-Level Access Control Bypass in Backpack CRUD

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query instead of the query configured through addClause() or addBaseClause(). An authenticated user who knows or guesses an out-of-scope record primary key can therefore modify, delete, or reorder records hidden by tenant, ownership, or other row-level access-control scopes. Applications that do not rely on CRUD query clauses for authorization are not affected by this specific bypass. The fix routes all three write operations through getModelWithCrudPanelQuery(), matching the scoped list and read behavior. This issue is fixed in versions 6.8.14 and 7.0.38.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54180
EUVD
EUVD-2026-77717

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
backpack crud From 6.0.0 (inc) to 6.8.14 (inc)
backpack crud 6.8.14
backpack crud 7.0.38
laravel-backpack crud From 6.0.0 (inc) to 6.8.14 (exc)
laravel-backpack crud From 7.0.0 (inc) to 7.0.38 (exc)
laravel-backpack crud 6.8.14
laravel-backpack crud 7.0.38

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Backpack CRUD package for Laravel. It affects versions 6.0.0 to 6.8.13 and 7.0.0 to 7.0.37. The issue occurs because Update, Delete, and Reorder operations bypass query scopes that are normally applied during read and list operations. This allows authenticated users to modify or delete records they should not have access to by guessing or knowing a record's primary key.

Detection Guidance

To detect this vulnerability, review your Backpack CRUD application logs for unauthorized update, delete, or reorder operations on records that should be inaccessible. Check if users can modify records outside their scoped permissions by testing with known primary keys of restricted records.

Impact Analysis

An attacker with valid credentials could exploit this to modify, delete, or reorder records they are not authorized to access. This could lead to unauthorized data changes, data loss, or disruption of application functionality. The impact depends on the application's use of CRUD query clauses for authorization.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating compliance requirements for data protection and privacy. GDPR and HIPAA require strict access controls and protection of personal or sensitive data. Exploitation of this flaw may result in non-compliance, potential legal penalties, and reputational damage.

Mitigation Strategies

Immediately update Backpack CRUD to versions 6.8.14 or 7.0.38 or later. As a temporary measure, add explicit Gate or Policy checks in the update(), destroy(), and reorder() methods of your CrudController to enforce row-level access control.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54180. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart