CVE-2026-110630

MediumCVSS 6.5

Published: 14/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.64%

49th percentile - higher than 49% of all known CVEs

Summary

VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.

Risk Assessment

An attacker can escalate privileges to the Owner role or other teams' roles and delete users outside their team, leading to system takeover and data loss.

Recommendation

Update VentureDrake Laravel CRM to version 2.4.0 or later, which fixes this vulnerability.

Other vulnerabilities in VentureDrake Laravel CRM

CVE-2026-110629Medium
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS