CVE-2026-110630
laravel-crm: VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment
venturedrake laravel-crmFrameworks
CVSS
7.0HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.64%Chance of exploitation activity in the next 30 days, higher than 49% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.4.0laravel-crmCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.
Text from CVE List
Affected versions 1
- laravel-crmaffected: all versions before 2.4.0CVE List
References 8
- github.com/venturedrake/laravel-crm/commit/d64b59fb9f7355e1be9951fbcc5f54ed715dc212Fixvia CVE List
- github.com/venturedrake/laravel-crm/commit/27bd5081004913660ccb3e0181b351a2e4ded104Fixvia CVE List
- github.com/venturedrake/laravel-crm/releases/tag/2.4.0Fixvia CVE List
- vulncheck.com/advisories/venturedrake-laravel-crm-before-2.4.0-privilege-escalation-via-unscoped-role-assignmentAdvisoryvia CVE List
- github.com/venturedrake/laravel-crm/issues/79Referencevia CVE List
- github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Http/Controllers/UserController.php#L87-L94Referencevia CVE List
- github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Livewire/Users/UserIndex.php#L83-L90Referencevia CVE List
- github.com/venturedrake/laravel-crmReferencevia CVE List