CVE-2026-110629

Published: Oct 14, 2026Modified: Oct 16, 2026Deferred

7.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (11)

https://github.com/venturedrake/laravel-crm

Source: disclosure@vulncheck.com

https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Http/routes.php#L573-L581

Source: disclosure@vulncheck.com

https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Livewire/Deals/DealIndex.php#L125-L170

Source: disclosure@vulncheck.com

https://github.com/venturedrake/laravel-crm/commit/049fc966029234a6d0f02b69efeabdb16e35bbb0

Source: disclosure@vulncheck.com

https://github.com/venturedrake/laravel-crm/commit/1a280cb22fc006f63fb96fe540dc4d651a8fb0a8

Source: disclosure@vulncheck.com

https://github.com/venturedrake/laravel-crm/commit/78dbf4e41afe48def4037c69d5dd7a34820122c3

Source: disclosure@vulncheck.com

https://github.com/venturedrake/laravel-crm/commit/cc41264eff5563f470984b8d2cfcc9ab4583c586

Source: disclosure@vulncheck.com

https://github.com/venturedrake/laravel-crm/issues/79

Source: disclosure@vulncheck.com

https://github.com/venturedrake/laravel-crm/issues/80

Source: disclosure@vulncheck.com

https://github.com/venturedrake/laravel-crm/releases/tag/2.4.0

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/venturedrake-laravel-crm-before-2.4.0-missing-authorization-via-livewire-actions

Source: disclosure@vulncheck.com

Timeline

No history available yet.