GHSA-vgmv-8xjc-6rch: High severity composer/backpack/crud vulnerability
Summary
Backpack CRUD's list and read operations correctly apply any query scopes registered via addClause() / addBaseClause() (e.g. tenant isolation, user ownership). However, the Update, Delete, and Reorder operations bypassed these scopes, fetching records directly from the unscoped model query.
An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths.
Applications that rely on addBaseClause for row-level access control (multi-tenancy, per-user data isolation) are affected.
Impact
Any Backpack CRUD panel that uses addBaseClause or addClause to restrict which rows a user may access is affected on its write operations. An authenticated low-privilege user can modify or delete records belonging to other tenants / users.
Patches
Apply the fixed release for your major version:
- v6: upgrade to 6.8.14 or later - v7: upgrade to 7.0.38 or later
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side.
Workarounds
If you cannot upgrade immediately, add explicit Gate / Policy checks in your CrudController's update(), destroy(), and reorder() methods to verify the authenticated user is permitted to act on the resolved record.
Credits
Reported by Vishal Shukla (@shukla304).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/backpack/crudto a version that resolves this vulnerability.Fixed in 7.0.38 - Upgrade
Upgrade
composer/backpack/crudto a version that resolves this vulnerability.Fixed in 6.8.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.8.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.38 - Configuration
If you cannot upgrade immediately, add explicit `Gate`/`Policy` checks in the Backpack CRUD Update, Delete, and Reorder operations so record ownership/tenant scope is enforced on write paths (not just read/list scopes).
Backpack CRUD Gate/Policy checks on Update/Delete/Reorder write paths = Add explicit authorization checks before calling update(), destroy(), and reorder() in your CrudController (or controller actions) to ensure the authenticated user is permitted to act on the resolved record
Event History
Frequently Asked Questions
Which Backpack CRUD releases include the fix?
For v6, upgrade to 6.8.14 or later. For v7, upgrade to 7.0.38 or later.
Which deployments are exposed?
CRUD panels that use addBaseClause or addClause to enforce row-level restrictions, such as tenant isolation or per-user ownership, are affected on write operations.
What does an attacker need to exploit this issue?
The attacker must be authenticated and able to know or guess a target record's primary key. A low-privilege user can then modify, delete, or reorder records that should not be visible to them.
Which actions were not applying the configured query scopes?
Update, Delete, and Reorder bypassed the scoped query used by list and read operations. The fixed releases resolve records for these actions through the same scoped query.