Laravel CRM EUVD-2026-101258

Exploitation requires an authenticated account that already holds user-management privileges in Laravel CRM (CVSS PR:H), reached through the user create/update flow in UserController (store/update) and the UserIndex Livewire delete() path. The core conditions are: (1) ability to submit or tamper with the 'role' parameter so Role::find() returns a role the caller is not entitled to assign (e.g. the 'Owner' role or a role scoped to another team); and (2) for the deletion impact, the teams feature in use so that cross-team users exist to be removed via the unscoped delete(). Limiting factors that reduce realistic risk below the raw score: the attacker must first possess privileged administrative/user-management access (no anonymous or low-privilege path), no user interaction by a victim is needed (UI:N), and the issue is fully fixed in version 2.4.0 - installations on 2.4.0+ with the AssignableRole rule and Owner-role guard are not affected.

This is a genuine but access-gated integrity/availability risk rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VI:H/VA:H, scoring 7.0 HIGH) confirms the dominant constraint: PR:H means the attacker must already hold a privileged, authenticated user-management (administrator) account in the CRM. There is no privilege boundary crossed from an anonymous or low-privilege user - this is horizontal/vertical escalation from an existing admin to Owner and across tenant/team boundaries. No EPSS score, no CISA KEV listing, and no public POC were supplied, so by the precision rules this is 'no public exploit identified at time of analysis.' An SSVC-style read: Exploitation=none observed, Automatable=no (requires an authenticated privileged session and knowledge of valid role/user IDs), Technical Impact=total within the application's authorization model. The confidentiality impact is explicitly VC:N/C:N - this flaw does not directly disclose data; it corrupts the authorization state (role assignment) and enables destructive deletion. Conflicting/soft signals to note: the vector asserts AV:N while the real precondition is a trusted insider or a compromised admin credential, so the 'network' vector overstates how reachable this is in practice - treat it as an insider/post-compromise escalation primitive, not a perimeter-breaching remote exploit. Net: moderate priority - patch promptly where Laravel CRM is multi-tenant/team-enabled, but it is not a drop-everything internet-facing threat.

An administrator (or an attacker who has phished/compromised an admin account) with user-management access opens the user create/edit form and tampers with the submitted role ID so that Role::find() resolves the privileged 'Owner' role or a role belonging to another team, granting themselves or a confederate unrestricted control. The same actor abuses the unscoped UserIndex delete() method to remove users belonging to other teams. No public POC is referenced, but the attack is trivial form-parameter tampering requiring only low attack complexity (AC:L) once authenticated.