{"action":"Upgrade backpack/crud to 6.8.15 or later.","affected":[{"fixed":"7.0.47","introduced":"7.0.0"},{"fixed":"6.8.15","introduced":"6.0.0"}],"component":"backpack/crud","cve_ids":["CVE-2026-57570"],"ecosystem":"Packagist","epss":0.0044,"exploited":false,"fixed_versions":["7.0.47","6.8.15"],"ghsa_id":"GHSA-42vx-43vc-x6pr","id":"tcs_01M5KETF2HWQ4J7PT3B4J2EMKS","modified_at":"2026-08-20T18:48:08.762936Z","published_at":"2026-08-20T18:42:31Z","references":["https://osv.dev/vulnerability/GHSA-42vx-43vc-x6pr","https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-42vx-43vc-x6pr","https://github.com/Laravel-Backpack/CRUD","https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.15","https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.47"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-42vx-43vc-x6pr","url":"https://osv.dev/vulnerability/GHSA-42vx-43vc-x6pr"}],"summary":"Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation"}