CVE-2026-110630: VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VentureDrake Laravel CRMto a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated administrator with user-management access can exploit it. The issue does not describe unauthenticated access or exploitation by ordinary users without those permissions.
What actions could an attacker take after exploiting it?
They can assign themselves or another account the Owner role or roles belonging to other teams. They can also delete users across team boundaries through the unscoped user deletion method.
Are deployments running version 2.4.0 affected?
The affected range is stated as versions before 2.4.0. Based on the provided data, version 2.4.0 is not included in the affected range.
How can administrators assess whether they may have been affected?
Review role-assignment activity for unexpected Owner-role grants or roles assigned across teams. Also review user-deletion activity for deletions performed against users outside the acting administrator's team.