Vulnerability-Lookup

CVE-2026-57570 (GCVE-0-2026-57570)

Vulnerability from cvelistv5 – Published: 2026-09-14 17:51 – Updated: 2026-09-14 18:11

Title

backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

Summary

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.15 and 7.0.47, HasMany and MorphMany handling through attachManyRelation during CRUD create and update operations accepts submitted child primary keys without consistently restricting updates to records belonging to the current parent or permitted by the developer-defined relation scope. An authenticated low-privilege administrator who can edit a parent form exposing an affected multiple-relation field can cause unrelated child records to be reassigned, detached, nulled, or deleted across ownership or tenant boundaries. Exploitation requires related records that should not be attachable or removable by that administrator and the absence of additional application-level authorization around submitted relation values. This issue is distinct from earlier direct main-entity CRUD scoping fixes because it affects secondary models modified by relationship-saving logic. This issue is fixed in versions 6.8.15 and 7.0.47.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 18:10 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/Laravel-Backpack/CRUD/security…	x_refsource_CONFIRM
https://github.com/Laravel-Backpack/CRUD/pull/6021	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/pull/6022	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/0…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/2…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Laravel-Backpack	CRUD	Affected: >= 6.0.0, < 6.8.15 Affected: >= 7.0.0, < 7.0.47	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57570",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T18:10:13.929535Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T18:11:21.485Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CRUD",
          "vendor": "Laravel-Backpack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.8.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.0.47"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.15 and 7.0.47, HasMany and MorphMany handling through attachManyRelation during CRUD create and update operations accepts submitted child primary keys without consistently restricting updates to records belonging to the current parent or permitted by the developer-defined relation scope. An authenticated low-privilege administrator who can edit a parent form exposing an affected multiple-relation field can cause unrelated child records to be reassigned, detached, nulled, or deleted across ownership or tenant boundaries. Exploitation requires related records that should not be attachable or removable by that administrator and the absence of additional application-level authorization around submitted relation values. This issue is distinct from earlier direct main-entity CRUD scoping fixes because it affects secondary models modified by relationship-saving logic. This issue is fixed in versions 6.8.15 and 7.0.47."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:51:07.852Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-42vx-43vc-x6pr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-42vx-43vc-x6pr"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/pull/6021",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/pull/6021"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/pull/6022",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/pull/6022"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/045ac00532aebbd2ddcad260ba86f980f000a800",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/045ac00532aebbd2ddcad260ba86f980f000a800"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/24cfd2f61f3b162c7bfd572368bc1b05c5f1fa75",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/24cfd2f61f3b162c7bfd572368bc1b05c5f1fa75"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.15"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.47",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.47"
        }
      ],
      "source": {
        "advisory": "GHSA-42vx-43vc-x6pr",
        "discovery": "UNKNOWN"
      },
      "title": "backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57570",
    "datePublished": "2026-09-14T17:51:07.852Z",
    "dateReserved": "2026-06-24T18:49:56.207Z",
    "dateUpdated": "2026-09-14T18:11:21.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-57570\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-14T18:17:57.180\",\"lastModified\":\"2026-09-14T19:17:36.150\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.15 and 7.0.47, HasMany and MorphMany handling through attachManyRelation during CRUD create and update operations accepts submitted child primary keys without consistently restricting updates to records belonging to the current parent or permitted by the developer-defined relation scope. An authenticated low-privilege administrator who can edit a parent form exposing an affected multiple-relation field can cause unrelated child records to be reassigned, detached, nulled, or deleted across ownership or tenant boundaries. Exploitation requires related records that should not be attachable or removable by that administrator and the absence of additional application-level authorization around submitted relation values. This issue is distinct from earlier direct main-entity CRUD scoping fixes because it affects secondary models modified by relationship-saving logic. This issue is fixed in versions 6.8.15 and 7.0.47.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"Laravel-Backpack\",\"product\":\"CRUD\",\"versions\":[{\"version\":\"\u003e= 6.0.0, \u003c 6.8.15\",\"status\":\"affected\"},{\"version\":\"\u003e= 7.0.0, \u003c 7.0.47\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-14T18:10:13.929535Z\",\"id\":\"CVE-2026-57570\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://github.com/Laravel-Backpack/CRUD/commit/045ac00532aebbd2ddcad260ba86f980f000a800\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/commit/24cfd2f61f3b162c7bfd572368bc1b05c5f1fa75\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/pull/6021\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/pull/6022\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.15\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.47\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-42vx-43vc-x6pr\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-57570\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-14T18:10:13.929535Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-14T18:10:45.594Z\"}}], \"cna\": {\"title\": \"backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation\", \"source\": {\"advisory\": \"GHSA-42vx-43vc-x6pr\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"Laravel-Backpack\", \"product\": \"CRUD\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 6.0.0, \u003c 6.8.15\"}, {\"status\": \"affected\", \"version\": \"\u003e= 7.0.0, \u003c 7.0.47\"}]}], \"references\": [{\"url\": \"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-42vx-43vc-x6pr\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-42vx-43vc-x6pr\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/pull/6021\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/pull/6021\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/pull/6022\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/pull/6022\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/commit/045ac00532aebbd2ddcad260ba86f980f000a800\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/commit/045ac00532aebbd2ddcad260ba86f980f000a800\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/commit/24cfd2f61f3b162c7bfd572368bc1b05c5f1fa75\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/commit/24cfd2f61f3b162c7bfd572368bc1b05c5f1fa75\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.15\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.15\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.47\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.47\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.15 and 7.0.47, HasMany and MorphMany handling through attachManyRelation during CRUD create and update operations accepts submitted child primary keys without consistently restricting updates to records belonging to the current parent or permitted by the developer-defined relation scope. An authenticated low-privilege administrator who can edit a parent form exposing an affected multiple-relation field can cause unrelated child records to be reassigned, detached, nulled, or deleted across ownership or tenant boundaries. Exploitation requires related records that should not be attachable or removable by that administrator and the absence of additional application-level authorization around submitted relation values. This issue is distinct from earlier direct main-entity CRUD scoping fixes because it affects secondary models modified by relationship-saving logic. This issue is fixed in versions 6.8.15 and 7.0.47.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-14T17:51:07.852Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-57570\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-14T18:11:21.485Z\", \"dateReserved\": \"2026-06-24T18:49:56.207Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-14T17:51:07.852Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-42VX-43VC-X6PR

Vulnerability from github – Published: 2026-08-20 18:42 – Updated: 2026-08-20 18:42

Summary

Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

Details

Vulnerability Details

Affected area: HasMany / MorphMany relation handling during CRUD create and update operations
CWE: CWE-862 — Missing Authorization
Severity: Medium
CVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

Backpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations.

When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model.

This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field.

Root Cause

The vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope.

As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form.

This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic.

Impact

An authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records.

Possible impact includes:

Unauthorized reassignment of related records across users, parents, or tenants.
Unauthorized detachment or removal of related records.
Data integrity issues in multi-tenant or permission-sensitive applications.

The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field.

Affected Conditions

An application may be affected when all of the following are true:

A Backpack CRUD form exposes a multiple-selection field for a HasMany or MorphMany relation.
The related model contains records that should not be attachable or removable by the current admin user.
The application relies on tenant, ownership, or authorization boundaries for those related records.
The application has not added its own additional validation or authorization checks around submitted relation values.

Recommended Fix

Backpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context.

The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs.

Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels.

Verification

The issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures.

The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check.

After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.47"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.8.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57570"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:42:31Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Vulnerability Details\n\nAffected area: HasMany / MorphMany relation handling during CRUD create and update operations  \nCWE: CWE-862 \u2014 Missing Authorization  \nSeverity: Medium  \nCVSS: 6.5 \u2014 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\n\n### Summary\n\nBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations.\n\nWhen an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model.\n\nThis could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field.\n\n### Root Cause\n\nThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope.\n\nAs a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form.\n\nThis issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic.\n\n### Impact\n\nAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records.\n\nPossible impact includes:\n\n- Unauthorized reassignment of related records across users, parents, or tenants.\n- Unauthorized detachment or removal of related records.\n- Data integrity issues in multi-tenant or permission-sensitive applications.\n\nThe issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field.\n\n### Affected Conditions\n\nAn application may be affected when all of the following are true:\n\n- A Backpack CRUD form exposes a multiple-selection field for a HasMany or MorphMany relation.\n- The related model contains records that should not be attachable or removable by the current admin user.\n- The application relies on tenant, ownership, or authorization boundaries for those related records.\n- The application has not added its own additional validation or authorization checks around submitted relation values.\n\n### Recommended Fix\n\nBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context.\n\nThe fix should ensure that related records are filtered through the relation\u2019s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs.\n\nApplications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels.\n\n### Verification\n\nThe issue was confirmed through an internal PHPUnit test against Backpack\u2019s existing Testbench fixtures.\n\nThe test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check.\n\nAfter applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal.",
  "id": "GHSA-42vx-43vc-x6pr",
  "modified": "2026-08-20T18:42:31Z",
  "published": "2026-08-20T18:42:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-42vx-43vc-x6pr"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Laravel-Backpack/CRUD"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.15"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.47"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-57570 (GCVE-0-2026-57570)

GHSA-42VX-43VC-X6PR

Vulnerability Details

Summary

Root Cause

Impact

Affected Conditions

Recommended Fix

Verification

Tags

Sightings

Nomenclature