CVE-2026-110629
laravel-crm: VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions
venturedrake laravel-crmFrameworks
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.57%Chance of exploitation activity in the next 30 days, higher than 46% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.4.0laravel-crmCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
Text from CVE List
Affected versions 1
- laravel-crmaffected: all versions before 2.4.0CVE List
References 11
- github.com/venturedrake/laravel-crm/commit/1a280cb22fc006f63fb96fe540dc4d651a8fb0a8Fixvia CVE List
- github.com/venturedrake/laravel-crm/commit/cc41264eff5563f470984b8d2cfcc9ab4583c586Fixvia CVE List
- github.com/venturedrake/laravel-crm/commit/049fc966029234a6d0f02b69efeabdb16e35bbb0Fixvia CVE List
- github.com/venturedrake/laravel-crm/commit/78dbf4e41afe48def4037c69d5dd7a34820122c3Fixvia CVE List
- github.com/venturedrake/laravel-crm/releases/tag/2.4.0Fixvia CVE List
- vulncheck.com/advisories/venturedrake-laravel-crm-before-2.4.0-missing-authorization-via-livewire-actionsAdvisoryvia CVE List
- github.com/venturedrake/laravel-crm/issues/79Referencevia CVE List
- github.com/venturedrake/laravel-crm/issues/80Referencevia CVE List
- github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Livewire/Deals/DealIndex.php#L125-L170Referencevia CVE List
- github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Http/routes.php#L573-L581Referencevia CVE List
- github.com/venturedrake/laravel-crmReferencevia CVE List