CVE-2026-54180: Backpack CRUD Auth Bypass Vulnerability

CVE-2026-54180 Overview

CVE-2026-54180 is a broken access control vulnerability in backpack/crud, a Laravel package that provides Create, Read, Update, and Delete operations for Backpack administration panels. The Update, Delete, and Reorder operations resolve records from the unscoped model query instead of the query configured through addClause() or addBaseClause(). An authenticated user who knows or guesses an out-of-scope record primary key can modify, delete, or reorder records hidden by tenant, ownership, or other row-level access-control scopes. The flaw is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Authenticated users can bypass row-level access controls to modify, delete, or reorder records belonging to other tenants or owners in multi-tenant Backpack CRUD applications.

Affected Products

• backpack/crud versions 6.0.0 through 6.8.13
• backpack/crud versions 7.0.0 through 7.0.37
• Laravel applications relying on CRUD query clauses (addClause()/addBaseClause()) for authorization

Discovery Timeline

• 2026-09-14 - CVE-2026-54180 published to NVD
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-54180

Vulnerability Analysis

Backpack CRUD allows developers to constrain the base query used to list records via addClause() and addBaseClause(). These clauses are commonly used to enforce tenant isolation, ownership checks, and row-level access control. While the list and read operations correctly honor these scoped queries, the Update, Delete, and Reorder write operations resolved records directly from $this->model, bypassing all configured constraints.

An authenticated user with legitimate access to their own subset of records could submit a request referencing a primary key belonging to another tenant. The write operation would then locate and mutate that out-of-scope record. The vulnerability specifically affects applications that rely on CRUD query clauses as the authorization mechanism.

Root Cause

The root cause is inconsistent query construction between read and write operations in the CRUD panel traits. The delete() and reorder() methods invoked $this->model->findOrFail($id) and $this->model->query() directly, ignoring the scoping applied to the CRUD panel query builder. The fix routes all three write operations through getModelWithCrudPanelQuery(), matching the scoped behavior already implemented for list and read operations.

Attack Vector

Exploitation requires authenticated access to a Backpack admin panel and knowledge or a guess of a primary key outside the attacker's authorized scope. The attacker sends a standard Update, Delete, or Reorder request substituting the target primary key. No special payload or protocol manipulation is required.

// Vulnerable delete() implementation (pre-patch)
public function delete($id)
{
    return (string) $this->model->findOrFail($id)->delete();
}

// Patched delete() implementation using scoped query
public function delete($id)
{
    return (string) $this->getModelWithCrudPanelQuery()->findOrFail($id)->delete();
}

// Vulnerable reorder() key resolution (pre-patch)
$itemKeys = $this->model->query()->select($primaryKey)->get()->pluck($primaryKey);

// Patched reorder() key resolution
$itemKeys = $this->getModelWithCrudPanelQuery()->select($primaryKey)->get()->pluck($primaryKey);

Source: GitHub Commit dd25c20 and GitHub Commit 76c3a6e

Detection Methods for CVE-2026-54180

Indicators of Compromise

• Successful DELETE, PUT, or POST requests to CRUD endpoints referencing primary keys the authenticated user should not access
• Reorder requests containing item IDs that fall outside the user's tenant or ownership scope
• Audit log entries showing record mutations attributed to users who lack a corresponding read history for those records

Detection Strategies

• Compare authenticated request principals against the tenant or owner column of the targeted record for every write operation on CRUD-managed models
• Instrument Eloquent model events (deleting, updating) to log the resolving user and cross-reference against configured scope clauses
• Review web server and application logs for enumeration patterns targeting sequential primary keys on CRUD Update, Delete, or Reorder routes

Monitoring Recommendations

• Enable Laravel query logging or an audit trail package on Backpack-managed models to capture write operations with the acting user and target key
• Alert on write operations whose target record's tenant identifier does not match the authenticated user's tenant claim
• Monitor Backpack admin panel routes for unusual volumes of Delete or Reorder requests from a single session

How to Mitigate CVE-2026-54180

Immediate Actions Required

• Upgrade backpack/crud to version 6.8.14 for the 6.x branch or 7.0.38 for the 7.x branch
• Audit all custom CRUD controllers that rely on addClause() or addBaseClause() for authorization and verify no additional write paths bypass scoping
• Review recent audit logs for unauthorized modifications to records belonging to other tenants or owners

Patch Information

The fix routes Update, Delete, and Reorder operations through getModelWithCrudPanelQuery(), ensuring write operations honor the same scoped query as list and read. Patched releases are available in GitHub Release 6.8.14 and GitHub Release 7.0.38. Full technical context is documented in GitHub Security Advisory GHSA-vgmv-8xjc-6rch.

Workarounds

• Enforce authorization independently of CRUD query clauses using Laravel policies or gates on Update, Delete, and Reorder controller actions
• Override the affected CRUD operations in application controllers to explicitly re-check ownership before invoking the parent implementation
• Restrict Backpack admin panel access to trusted users until the upgrade is deployed

# Upgrade via Composer
composer require backpack/crud:^6.8.14
# or for the 7.x branch
composer require backpack/crud:^7.0.38
composer update backpack/crud