CVE-2026-110629: VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with a read-only role can exploit it. The flaw lets such users bypass Spatie role permissions through exposed Livewire action methods and unguarded Activities and Products routes.
What actions can an attacker perform?
A read-only user can invoke actions such as delete, won, lost, or reopen on deal-related Livewire components. The issue can be used to modify deals, quotes, orders, and invoices.
Are installations running version 2.4.0 or later affected?
The issue is identified as affecting VentureDrake Laravel CRM versions before 2.4.0. The provided information does not indicate that version 2.4.0 or later is affected.