CVE-2026-110629 in Laravel CRM
Summary
by MITRE • 10/15/2026
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in VentureDrake Laravel CRM versions prior to 2.4.0 represents a critical failure in server-side access control mechanisms, specifically classified under CWE-862: Missing Authorization. This flaw stems from an improper implementation of role-based access controls within the application's Livewire action methods and associated route handlers. While the system correctly enforces permissions for standard web page rendering and basic CRUD operations through Spatie Laravel Permission packages, it fails to validate user roles when executing specific backend actions triggered via AJAX or Livewire components. This architectural inconsistency allows authenticated users who have been assigned read-only roles to execute state-changing commands that should be restricted to administrators or sales personnel with higher privilege levels.
The technical root cause lies in the lack of middleware enforcement on certain API endpoints and Livewire component methods. In a properly secured Laravel application, authorization checks are typically applied at multiple layers: route definition, controller action, and model events. However, in this vulnerable version, specific methods such as delete, won, lost, or reopen within components like DealIndex were not gated by the necessary policy checks. Furthermore, unguarded routes for Activities and Products lacked sufficient validation logic to ensure that only authorized roles could interact with them. This oversight creates a direct path for privilege escalation where an attacker leveraging a low-privilege account can manipulate critical business data without triggering any security alerts or permission denials.
The operational impact of this vulnerability is severe, as it compromises the integrity and confidentiality of sensitive customer relationship management data. An authenticated user with read-only access can effectively bypass these restrictions to delete existing deals, alter their status by marking them as won or lost, or reopen closed opportunities. Additionally, the ability to modify activities and products means that an attacker can inject false records into the system's history or change product configurations, leading to inaccurate reporting and potential financial discrepancies. This level of unauthorized modification undermines trust in the CRM platform and could lead to significant business losses if exploited by malicious insiders or compromised accounts.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK technique T1078: Valid Accounts, where an attacker uses legitimate credentials to perform actions outside their intended scope. It also relates to CWE-269: Improper Privilege Management, as the system fails to enforce least privilege principles during specific operational workflows. The exploitation does not require complex injection techniques or network-level attacks; instead, it relies on crafting valid HTTP requests with appropriate session cookies but manipulated parameters that target the unprotected Livewire endpoints. This simplicity makes the vulnerability particularly dangerous in environments where user accounts may be shared or credentials are easily compromised through phishing or credential stuffing attacks.
To mitigate this risk, organizations must immediately upgrade to VentureDrake Laravel CRM version 2.4.0 or later, which addresses these authorization gaps by implementing robust policy checks across all Livewire actions and API routes. For systems that cannot be upgraded instantly, a temporary workaround involves manually reviewing the route definitions for Activities and Products to ensure they are protected by middleware requiring specific role permissions. Developers should also audit all custom Livewire components to verify that every public method includes explicit authorization logic using Laravel's built-in policy system or Spatie permission checks. Regular security audits focusing on access control lists and role-based permissions are essential to prevent similar misconfigurations in future updates, ensuring that the principle of least privilege is strictly enforced across all application layers.