CVE-2026-110630: falha de alta gravidade em venturedrake laravel-crm
VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7epss 0.6%
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
venturedrake · laravel-crmCVEs relacionadas — venturedrake laravel-crm
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/venturedrake/laravel-crmhttps://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Http/Controllers/UserController.php#L87-L94https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Livewire/Users/UserIndex.php#L83-L90https://github.com/venturedrake/laravel-crm/commit/27bd5081004913660ccb3e0181b351a2e4ded104https://github.com/venturedrake/laravel-crm/commit/d64b59fb9f7355e1be9951fbcc5f54ed715dc212https://github.com/venturedrake/laravel-crm/issues/79https://github.com/venturedrake/laravel-crm/releases/tag/2.4.0https://www.vulncheck.com/advisories/venturedrake-laravel-crm-before-2.4.0-privilege-escalation-via-unscoped-role-assignment