EUVD-2026-101257
GHSA-h9jr-9j2x-qpfm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as read-only CRM user
-
ExploitInvoke Livewire delete/won/lost method on DealIndex
-
ExecutionSpatie role permission check bypassed
-
ImpactModify or delete deals, quotes, orders, invoices
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated Laravel CRM account holding a low-privilege Spatie role (e.g. a read-only user); PR:L confirms authentication is needed and no admin rights are required. The attacker then invokes Livewire action methods (delete, won, lost, reopen) on components such as DealIndex, or accesses the unguarded Activities and Products routes (deal-products, quote-products, order-products), which lacked 'can:view'/'can:update' authorization middleware before 2.4.0. Exploitation is limited to deployments running a version before 2.4.0 that actually provision restricted/read-only accounts; a single-admin or fully-trusted-user install has little exposure, and no user interaction or elevated privileges are needed beyond the initial low-trust login. |
| Impact | This is a missing-authorization flaw (CWE-862) scored CVSS 4.0 7.1 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N. The signals are internally consistent and point to a genuine but bounded integrity risk rather than a critical mass-exploitation event. PR:L confirms an authenticated (low-privilege) account is required - this is privilege escalation by an existing insider, not remote-unauthenticated compromise. Impact is integrity-only (VI:H; confidentiality and availability both N), matching the description: read-only users can modify/delete deals, quotes, orders and invoices but there is no data-exfiltration or denial-of-service primitive. No EPSS score, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the finding originates from VulnCheck research with a vendor patch already available. The practical risk is therefore moderate and scoped to deployments that provision low-trust/read-only CRM accounts - a real priority for multi-tenant or large-team CRM installs, but far lower real-world urgency than a network-unauthenticated RCE despite the 'High' label. |
| Exploit ScenarioDerived | A low-privilege 'read-only' user who should only be able to view records logs into Laravel CRM and directly invokes Livewire action methods (delete, won, lost, reopen) on components such as DealIndex, or hits the unguarded Activities/Products routes. Because the Spatie role permission check is never enforced on these actions, the user successfully modifies or deletes deals, quotes, orders and invoices they were never authorized to touch. No public exploit code was identified, and exploitation requires only a valid authenticated session with network access to the app. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Missing authorization checks in VentureDrake Laravel CRM before 2.4.0 allow any authenticated user holding a low-privilege Spatie role - including read-only accounts - to modify deals, quotes, orders and invoices by invoking Livewire action methods such as delete, won, lost or reopen on components like DealIndex, or by reaching the unguarded Activities and Products routes. The flaw is rated CVSS 4.0 7.1 (High) and requires only a valid non-privileged login (PR:L), with no user interaction and no administrative rights; the integrity impact is high while confidentiality and availability are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available in version 2.4.0.
RemediationAI
Vendor-released patch: upgrade to Laravel CRM 2.4.0 or later (https://github.com/venturedrake/laravel-crm/releases/tag/2.4.0); the underlying fixes are the upstream commits 1a280cb22fc006f63fb96fe540dc4d651a8fb0a8, cc41264eff5563f470984b8d2cfcc9ab4583c586, 049fc966029234a6d0f02b69efeabdb16e35bbb0 and 78dbf4e41afe48def4037c69d5dd7a34820122c3, which add 'can:view'/'can:update' middleware to the deal-products, quote-products and order-products routes and tighten the DealProduct, QuoteProduct and OrderProduct controllers - these commits can be cherry-picked onto a custom fork if a full upgrade is not immediately possible. As an interim compensating control, remove or temporarily suspend all low-privilege and read-only Spatie roles (the attack requires an authenticated non-trusted account, so eliminating such accounts removes the exposure), and, if restricted roles must remain, apply the same authorization middleware manually to the Products routes and wrap the Livewire deal action methods (delete, won, lost, reopen) with explicit policy checks; be aware that the latter requires code changes that will be overwritten on the next upgrade. Additional hardening with a clear trade-off: restrict network access to the CRM (VPN or IP allowlist) reduces reachability from remote attackers but does not stop an insider or a compromised low-privilege credential, and it does not address the missing check itself. Review application logs for unexpected delete, won, lost, reopen or product-route invocations by restricted accounts, since those actions are the observable signature of exploitation. No public exploit code was identified at the time of analysis, so mass scanning is less likely than targeted abuse by an authenticated tenant user.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization) in VentureDrake's Laravel CRM, an open-source CRM built on the Laravel framework with Livewire for reactive UI components and the Spatie laravel-permission package for role-based access control. In affected releases, Livewire action methods on components such as DealIndex (see the linked DealIndex.php source lines 125-170) executed without verifying the caller's Spatie permissions, and the Activities and Products routes registered in src/Http/routes.php (lines 573-581, plus the deal-products, quote-products and order-products route groups) lacked the Laravel 'can:view,<model>' and 'can:update,<model>' authorization middleware entirely. Because those route and component handlers performed no policy check, the authorization layer that Spatie provides was simply never consulted, letting a user assigned a restricted role perform state-changing operations the role explicitly forbids. The upstream fix confirms the class of bug: the patch commit (1a280cb) adds middleware(['can:view,deal']), middleware(['can:update,deal']) and the equivalent quote/order variants to the index, create, store, show, edit, update and destroy routes, and reworks the DealProductController, QuoteProductController and OrderProductController edit methods to accept the parent Deal/Quote/Order model plus the product so that route-model-bound policy checks apply. The affected CPE is cpe:2.3:a:venturedrake:laravel-crm:*:*:*:*:*:*:*:*, i.e. all releases prior to 2.4.0.
Know when Laravel Crm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Authenticated low-privilege user over the network (PR:L, AV:N, AC:L) bypasses authorization to alter records, yielding high integrity impact with no confidentiality or availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
Executive ViewAI
VentureDrake Laravel CRM deployments running versions prior to 2.4.0 permit any authenticated user - including read-only accounts - to alter deals, quotes, orders, and invoices, exposing the organization's sales pipeline and financial records to unauthorized modification by insiders or anyone holding a basic login. Because confidentiality and availability are unaffected but data integrity is fully compromised, the primary risk is corrupted revenue reporting, unreliable forecasting, and weakened audit and compliance assurances rather than data theft or downtime. Leadership should treat this as a governance and financial-reporting integrity issue requiring prompt remediation across all affected CRM instances.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Laravel Crm
View allAdministrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the pr
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the ent
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper w
Unauthenticated remote users can still reach the installer and admin-config-setup endpoints of Krayin CRM (laravel-crm)
Missing authentication on Krayin CRM's admin mail ingest route lets any remote, unauthenticated attacker POST crafted RF
Incorrect authorization (CWE-863) in VentureDrake Laravel CRM before 2.4.0 allows an authenticated account that already
Improper privilege management in Krayin laravel-crm up to and including 2.2.5 lets an authenticated back-office user who
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access a
Cross-site scripting in Krayin Laravel CRM through 2.2.5 lets an authenticated user with access to the admin configurati
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges
Stored cross-site scripting in Krayin CRM (laravel-crm) up to and including version 2.2.5 lets an authenticated administ
Exploit-DB