CVE-2026-57570
Received Received - Intake

Privilege Escalation in Backpack CRUD via Relation Handling

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.15 and 7.0.47, HasMany and MorphMany handling through attachManyRelation during CRUD create and update operations accepts submitted child primary keys without consistently restricting updates to records belonging to the current parent or permitted by the developer-defined relation scope. An authenticated low-privilege administrator who can edit a parent form exposing an affected multiple-relation field can cause unrelated child records to be reassigned, detached, nulled, or deleted across ownership or tenant boundaries. Exploitation requires related records that should not be attachable or removable by that administrator and the absence of additional application-level authorization around submitted relation values. This issue is distinct from earlier direct main-entity CRUD scoping fixes because it affects secondary models modified by relationship-saving logic. This issue is fixed in versions 6.8.15 and 7.0.47.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-57570
EUVD
EUVD-2026-77709

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
backpack crud to 6.8.15 (inc)
backpack crud 7.0.47
laravel_backpack crud From 6.0.0 (inc) to 6.8.15 (exc)
laravel_backpack crud 6.8.15
laravel_backpack crud 7.0.47

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the backpack/crud package for Laravel, allowing authenticated low-privilege administrators to manipulate related records through attachManyRelation during create or update operations. It enables reassignment, detachment, nulling, or deletion of unrelated child records across ownership or tenant boundaries without proper restrictions.

Detection Guidance

This vulnerability affects the backpack/crud Laravel package versions between 6.0.0 and 6.8.15 and 7.0.0 and 7.0.47. To detect it, check your installed package version using composer show backpack/crud. If the version falls within the vulnerable range, the system is potentially affected.

Impact Analysis

An attacker with low privileges could exploit this to modify or delete records they should not have access to, potentially causing data corruption, unauthorized access, or loss of critical information. This could affect data integrity and system functionality.

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's data integrity and confidentiality requirements or HIPAA's access controls. Non-compliance risks include fines, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update the backpack/crud package to version 6.8.15 or later for the 6.x branch, or 7.0.47 or later for the 7.x branch. Use composer update backpack/crud to apply the fix. Additionally, review application-level authorization logic for relation fields to ensure proper scoping and prevent unauthorized reassignments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57570. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart