« Volver al listado

CVE-2026-110630

Estado: RecibidaAlta (7)—

VentureDrake Laravel CRM anterior a la 2.4.0 contiene una vulnerabilidad de autorización incorrecta en la gestión de usuarios que permite a administradores autenticados asignar roles sin restricciones mediante Role::find. Los atacantes con acceso a la gestión de usuarios pueden asignar el rol Owner u otros roles de otros equipos y eliminar usuarios de otros equipos a través del método delete() de UserIndex, que no tiene un ámbito definido.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

FIRST aún no ha puntuado esta CVE (habitual en CVEs muy recientes o rechazadas).

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector AV:N/PR:H/UI:N exige administrador autenticado; el texto indica asignar roles sin restricción (Owner) mediante Role::find y borrar usuarios de otros equipos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationDisable or Remove Feature or ProgramVulnerability ScanningUser Account ManagementThreat Intelligence Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Venturedrake — Laravel CRMAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-110630",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-110630",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-14T20:20:04.862530Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.2
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "repo": "https://github.com/venturedrake/laravel-crm",
          "vendor": "venturedrake",
          "product": "laravel-crm",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.4.0",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:composer/venturedrake/laravel-crm",
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-14T15:17:15.843",
  "references": [
    {
      "url": "https://github.com/venturedrake/laravel-crm",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Http/Controllers/UserController.php#L87-L94",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Livewire/Users/UserIndex.php#L83-L90",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://github.com/venturedrake/laravel-crm/commit/27bd5081004913660ccb3e0181b351a2e4ded104",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://github.com/venturedrake/laravel-crm/commit/d64b59fb9f7355e1be9951fbcc5f54ed715dc212",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://github.com/venturedrake/laravel-crm/issues/79",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://github.com/venturedrake/laravel-crm/releases/tag/2.4.0",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/venturedrake-laravel-crm-before-2.4.0-privilege-escalation-via-unscoped-role-assignment",
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method."
    }
  ],
  "lastModified": "2026-10-14T21:17:35.703",
  "sourceIdentifier": "disclosure@vulncheck.com"
}