CVE-2026-110629
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
Risk Assessment
Users with limited permissions can modify critical business data such as deals, quotes, orders, and invoices, potentially leading to financial losses and data integrity breaches.
Recommendation
Update VentureDrake Laravel CRM to version 2.4.0 or later, which fixes this vulnerability.
Other vulnerabilities in VentureDrake Laravel CRM
Original NVD description (English source)
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS