GHSA-vgmv-8xjc-6rch: High severity composer/backpack/crud vulnerability

Published Aug 20, 2026
·
Updated

Summary

Backpack CRUD's list and read operations correctly apply any query scopes registered via addClause() / addBaseClause() (e.g. tenant isolation, user ownership). However, the Update, Delete, and Reorder operations bypassed these scopes, fetching records directly from the unscoped model query.

An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths.

Applications that rely on addBaseClause for row-level access control (multi-tenancy, per-user data isolation) are affected.

Impact

Any Backpack CRUD panel that uses addBaseClause or addClause to restrict which rows a user may access is affected on its write operations. An authenticated low-privilege user can modify or delete records belonging to other tenants / users.

Patches

Apply the fixed release for your major version:

- v6: upgrade to 6.8.14 or later - v7: upgrade to 7.0.38 or later

The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side.

Workarounds

If you cannot upgrade immediately, add explicit Gate / Policy checks in your CrudController's update(), destroy(), and reorder() methods to verify the authenticated user is permitted to act on the resolved record.

Credits

Reported by Vishal Shukla (@shukla304).

Affected Software

2 affected componentsFixes available
composer/backpack/crud>=7.0.0<7.0.38
7.0.38
composer/backpack/crud>=6.0.0<6.8.14
6.8.14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade composer/backpack/crud to a version that resolves this vulnerability.

    Fixed in 7.0.38
  2. Upgrade

    Upgrade composer/backpack/crud to a version that resolves this vulnerability.

    Fixed in 6.8.14
  3. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.8.14
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 7.0.38
  5. Configuration

    If you cannot upgrade immediately, add explicit `Gate`/`Policy` checks in the Backpack CRUD Update, Delete, and Reorder operations so record ownership/tenant scope is enforced on write paths (not just read/list scopes).

    Backpack CRUD Gate/Policy checks on Update/Delete/Reorder write paths = Add explicit authorization checks before calling update(), destroy(), and reorder() in your CrudController (or controller actions) to ensure the authenticated user is permitted to act on the resolved record

Event History

Aug 20, 2026
Advisory Published
via GitHub·06:38 PM
Data Sourced
via GitHub·06:38 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

Which Backpack CRUD releases include the fix?

For v6, upgrade to 6.8.14 or later. For v7, upgrade to 7.0.38 or later.

2

Which deployments are exposed?

CRUD panels that use addBaseClause or addClause to enforce row-level restrictions, such as tenant isolation or per-user ownership, are affected on write operations.

3

What does an attacker need to exploit this issue?

The attacker must be authenticated and able to know or guess a target record's primary key. A low-privilege user can then modify, delete, or reorder records that should not be visible to them.

4

Which actions were not applying the configured query scopes?

Update, Delete, and Reorder bypassed the scoped query used by list and read operations. The fixed releases resolve records for these actions through the same scoped query.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203