CVE-2026-57570: Backpack CRUD Privilege Escalation

CVE-2026-57570 Overview

CVE-2026-57570 is a missing authorization vulnerability [CWE-862] in backpack/crud, the Create, Read, Update, and Delete component of Backpack for Laravel administration panels. The flaw affects versions 6.0.0 through 6.8.14 and 7.0.0 through 7.0.46. During CRUD create and update operations, HasMany and MorphMany handling via attachManyRelation accepts submitted child primary keys without restricting updates to records owned by the current parent or the developer-defined relation scope. An authenticated low-privilege administrator can reassign, detach, null, or delete unrelated child records across tenant boundaries.

Critical Impact
A low-privilege administrator editing a parent form can manipulate child records belonging to other tenants, causing cross-tenant data integrity loss, unauthorized reassignment, or deletion.

Affected Products

Laravel Backpack CRUD 6.0.0 through 6.8.14
Laravel Backpack CRUD 7.0.0 through 7.0.46
Applications exposing multi-relation fields backed by HasMany or MorphMany relationships

Discovery Timeline

2026-09-14 - CVE-2026-57570 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-57570

Vulnerability Analysis

The vulnerability resides in Backpack CRUD's relationship-saving logic for multi-relation fields. When a parent entity form is submitted, attachManyRelation processes submitted child primary keys for HasMany and MorphMany relationships. The code trusts the primary keys sent by the client without verifying that the referenced child records belong to the current parent or fall within a developer-defined relation scope.

As a result, an authenticated administrator who can edit any parent entity exposing an affected multi-relation field can submit primary keys of unrelated child records. The framework will then reassign those records to the current parent, detach them from their legitimate parent, null out their foreign keys, or delete them, depending on the relation configuration. This issue is distinct from earlier main-entity scoping fixes because it affects secondary models mutated by relationship persistence logic rather than the primary CRUD entity.

Root Cause

The root cause is missing authorization on submitted relation identifiers. The getVerifiedBelongsToInputs verification step was absent from the input pipeline in src/app/Library/CrudPanel/Traits/Input.php, allowing untrusted child IDs to flow directly into Eloquent relationship operations without ownership checks.

Attack Vector

Exploitation requires an authenticated low-privilege administrator with edit access to a parent form containing a vulnerable multi-relation field. The attacker manipulates the submitted form to include primary keys of child records they should not control, and the framework applies the reassignment or deletion server-side.

php

// Patch: src/app/Library/CrudPanel/Traits/Input.php (commit 045ac00 / 24cfd2f)
$input = $this->excludeRelationFieldsExceptBelongsTo($input, $fields, $relationMethod);
$input = $this->changeBelongsToNamesFromRelationshipToForeignKey($input, $fields);
+$input = $this->getVerifiedBelongsToInputs($input, $fields);

return $input;
// Source: https://github.com/Laravel-Backpack/CRUD/commit/045ac00532aebbd2ddcad260ba86f980f000a800

The added getVerifiedBelongsToInputs call validates submitted relationship identifiers against permitted scope before they reach the persistence layer.

Detection Methods for CVE-2026-57570

Indicators of Compromise

Unexpected reassignment of child records to parents owned by a different tenant or user in HasMany/MorphMany tables
Foreign key columns nulled or updated on child records without a corresponding legitimate administrator workflow
Deletion of child records shortly after a low-privilege administrator submitted a parent CRUD update

Detection Strategies

Audit application logs for CRUD update requests that modify parent entities and correlate them with row changes in related child tables
Enable database-level audit triggers on tables backing HasMany and MorphMany relationships to capture unexpected UPDATE and DELETE operations
Review Laravel model events (updated, deleted) on child models and log the acting user plus the parent context

Monitoring Recommendations

Alert on cross-tenant foreign key transitions where a child record's parent_id changes to a parent owned by a different tenant
Monitor administrator sessions performing high volumes of relationship modifications in short time windows
Track Composer dependency versions in CI and flag deployments still running backpack/crud below 6.8.15 or 7.0.47

How to Mitigate CVE-2026-57570

Immediate Actions Required

Upgrade backpack/crud to version 6.8.15 (6.x branch) or 7.0.47 (7.x branch) as published in the vendor releases
Review all CRUD controllers exposing HasMany or MorphMany fields and inventory which administrator roles can edit them
Add application-level authorization (Laravel policies or gates) around submitted relation identifiers as defense in depth

Patch Information

The fix is delivered in GitHub Release 6.8.15 and GitHub Release 7.0.47. The changes are implemented in commit 045ac00 and commit 24cfd2f, corresponding to PR #6021 and PR #6022. Full details are in the GHSA-42vx-43vc-x6pr advisory.

Workarounds

Restrict which administrators can edit parent entities exposing affected multi-relation fields until patching is complete
Implement Laravel policies that validate every submitted child primary key against the acting user's tenant scope
Temporarily replace affected HasMany/MorphMany widgets with read-only displays for low-privilege roles

bash

# Upgrade via Composer
composer require backpack/crud:^6.8.15
# or for the 7.x branch
composer require backpack/crud:^7.0.47
composer update backpack/crud