CVE-2026-57570
1 advisory.
Packagist/backpack/crud CVE-2026-57570: medium 6.5
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
Action: Upgrade backpack/crud to 6.8.15 or later.
composer require backpack/crud:7.0.47composer require backpack/crud:6.8.15Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.0.0 | 7.0.47 | - |
| 6.0.0 | 6.8.15 | - |
Fixed versions
| 7.0.47 | 6.8.15 |
Sources
- osv: GHSA-42vx-43vc-x6pr
- https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-42vx-43vc-x6pr
- https://github.com/Laravel-Backpack/CRUD
- https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.15
- https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.47
CVE-2026-57570 · published · modified · JSON