CVE-2026-54180: 
PHP vulnerability analysis and mitigation

CVE-2026-54180 is an Insecure Direct Object Reference (IDOR) vulnerability in Laravel Backpack CRUD that allows authenticated low-privilege users to update, delete, or reorder records belonging to other tenants or users by bypassing query scope restrictions on write operations. It affects backpack/crud versions >= 6.0.0 < 6.8.14 and >= 7.0.0 < 7.0.38. The vulnerability was originally reported by Vishal Shukla (@shukla304), first published on June 15, 2026, and added to the GitHub Advisory Database on August 20, 2026. It carries a CVSS v3.1 base score of 7.6 (High) (GitHub Advisory).

The root cause is that Backpack CRUD's list and read operations correctly apply query scopes registered via addClause() / addBaseClause() (used for tenant isolation and user ownership), but the Update, Delete, and Reorder operations bypassed these scopes entirely, fetching records directly from the unscoped model query. This is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-863 (Incorrect Authorization). An authenticated attacker who knows or can enumerate a record's primary key can supply it directly in write-path requests, causing the application to act on records outside the attacker's authorized scope without any access control check (GitHub Advisory, Security Advisory).

Successful exploitation allows an authenticated low-privilege user to modify or delete records belonging to other tenants or users in any Backpack CRUD panel that relies on addBaseClause or addClause for row-level access control. The primary impact is a high integrity loss (unauthorized data modification or deletion across tenant boundaries), with limited confidentiality exposure (e.g., inferring record existence via primary key enumeration) and limited availability impact (record deletion). Multi-tenant SaaS applications built on Backpack CRUD are particularly at risk, as cross-tenant data manipulation could lead to data corruption, unauthorized disclosure, and breach of tenant isolation guarantees (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the advisory publication date. The vulnerability requires only a valid authenticated session with low privileges, making it accessible to any registered user in affected multi-tenant applications. No threat actor attribution or CISA KEV catalog listing has been identified. The EPSS score is not yet published in available sources (GitHub Advisory).

1. Reconnaissance: Authenticate to a Backpack CRUD-powered application as a low-privilege user. Identify CRUD panels that manage resources (e.g., /admin/items).
2. Enumerate primary keys: Browse the list view to observe record IDs visible to your account. Note the ID format (typically sequential integers).
3. Craft a write-path request: Construct an HTTP PUT/PATCH request to the update endpoint (e.g., POST /admin/items/{target_id} with _method=PUT) or a DELETE request to DELETE /admin/items/{target_id}, substituting a primary key belonging to another tenant or user.
4. Bypass scope enforcement: Because the Update/Delete/Reorder handlers resolve the record via the unscoped model query, the application fetches and acts on the target record without checking the attacker's authorized scope.
5. Achieve unauthorized modification or deletion: The targeted record is updated with attacker-supplied data, deleted, or reordered — even though it belongs to a different tenant or user that the attacker cannot see in the list view (GitHub Advisory, Security Advisory).

• Network: HTTP PUT/PATCH/DELETE requests to Backpack CRUD admin endpoints (e.g., /admin/{resource}/{id}) where the {id} values do not correspond to records visible in the authenticated user's list view; repeated requests cycling through sequential or non-sequential IDs.
• Logs: Laravel application logs showing successful update or delete operations on records with IDs outside the user's normal scope; access log entries with 200 responses to write-path requests for IDs the user has never accessed via GET.
• Database: Audit trail or change history showing modifications or deletions of records attributed to a user who does not own those records; unexpected changes to records in multi-tenant tables where the tenant_id or user_id does not match the acting user.

Upgrade to the patched release for your major version: v6 → 6.8.14 or later; v7 → 7.0.38 or later. The fix ensures that Update, Delete, and Reorder operations resolve records through the same scoped query used by the read side, enforcing addBaseClause/addClause restrictions consistently. If an immediate upgrade is not possible, add explicit Laravel Gate / Policy checks in your CrudController's update(), destroy(), and reorder() methods to verify the authenticated user is authorized to act on the resolved record (GitHub Advisory, v6.8.14 Release, v7.0.38 Release).

The vulnerability was reported by security researcher Vishal Shukla (@shukla304) and coordinated through the Laravel-Backpack/CRUD maintainer tabacitu. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified at this time (Security Advisory).