Backpack CRUD CVE-2026-54180

Exploitation requires three concurrent conditions: first, the target Backpack CRUD panel must use addBaseClause() or addClause() to implement row-level scope restrictions such as tenant isolation or per-user ownership - panels that do not register any such clauses are not affected by this bypass; second, the attacker must hold a valid authenticated session with access to the affected CRUD panel (CVSS PR:L confirms low-privilege authentication is sufficient, not unauthenticated access); third, the attacker must know or be able to enumerate the primary key of a target record, which is trivially achievable against sequential integer IDs via simple iteration. Limiting factors include: applications using UUID or other non-sequential primary key schemes increase the guessing burden; applications with supplementary Laravel Gate or Policy checks on the controller methods remain protected even on unpatched versions; and unauthenticated attackers cannot reach the write endpoints.

The CVSS 3.1 score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) accurately reflects the threat profile: network-accessible, low-complexity exploitation requiring only a valid low-privilege session, with high integrity impact from unrestricted cross-tenant write access. The confidentiality impact is appropriately rated Low rather than High because the read path is correctly scoped - the attacker cannot directly read unauthorized records through this flaw alone, though update payloads may incidentally confirm field values. No EPSS score was provided in the input data, making probabilistic exploitation estimates unavailable. CISA KEV status is not indicated and no public proof-of-concept has been identified, so active exploitation cannot be confirmed. Despite the absence of KEV/POC signals, the real-world risk for multi-tenant Backpack deployments is substantial: sequential integer primary keys are trivially enumerable, no special tooling is required beyond a standard HTTP client, and the attack is repeatable across every unprotected CRUD panel. Applications not using addBaseClause() or addClause() for row-level authorization are not exposed to this specific bypass, which meaningfully narrows the affected population but does not reduce urgency for those that are.

An authenticated low-privilege user in a multi-tenant Backpack CRUD application iterates through sequential integer primary keys in HTTP write requests - for example, POST /admin/products/1/edit, /admin/products/2/edit - targeting records outside their tenant's authorized scope. Because the Update, Delete, and Reorder code paths resolve records via an unscoped Eloquent query, the application acts on any matched record regardless of tenant ownership, allowing the attacker to overwrite or delete records belonging to other tenants using only a standard browser or HTTP client. No public proof-of-concept has been identified at time of analysis, but the attack requires no specialized tooling beyond a valid authenticated session.