« Volver al listado

CVE-2026-54180

Estado: AplazadaAlta (7.6)—

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query instead of the query configured through addClause() or addBaseClause(). An authenticated user who knows or guesses an out-of-scope record primary key can therefore modify, delete, or reorder records hidden by tenant, ownership, or other row-level access-control scopes.

Leer descripción completaMostrar menos

Applications that do not rely on CRUD query clauses for authorization are not affected by this specific bypass. The fix routes all three write operations through getModelWithCrudPanelQuery(), matching the scoped list and read behavior. This issue is fixed in versions 6.8.14 and 7.0.38.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de escalada de acceso en servicio remoto (API CRUD) que requiere autenticación (PR:L). Usuario autenticado bypasa controles de acceso por fila (row-level scopes) para modificar, eliminar o reordenar registros ajenos. Impacto: abuso de credenciales válidas (T1078), manipulación de dato

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Laravel — LaravelAIYangyouwang — CrudAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-54180",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54180",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-14T19:20:44.526700Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Laravel-Backpack",
          "product": "CRUD",
          "versions": [
            {
              "status": "affected",
              "version": ">= 6.0.0, < 6.8.14"
            },
            {
              "status": "affected",
              "version": ">= 7.0.0, < 7.0.38"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-09-14T18:17:53.070",
  "references": [
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/dd25c2086b8ea2cb765993b65876c66ab824eef0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5991",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5994",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-vgmv-8xjc-6rch",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query instead of the query configured through addClause() or addBaseClause(). An authenticated user who knows or guesses an out-of-scope record primary key can therefore modify, delete, or reorder records hidden by tenant, ownership, or other row-level access-control scopes. Applications that do not rely on CRUD query clauses for authorization are not affected by this specific bypass. The fix routes all three write operations through getModelWithCrudPanelQuery(), matching the scoped list and read behavior. This issue is fixed in versions 6.8.14 and 7.0.38."
    }
  ],
  "lastModified": "2026-09-30T17:51:56.193",
  "sourceIdentifier": "security-advisories@github.com"
}