CVE-2026-57570: 
PHP vulnerability analysis and mitigation

CVE-2026-57570 is a Missing Authorization (CWE-862) vulnerability in Laravel Backpack CRUD affecting HasMany and MorphMany relationship field handling during create and update operations. It allows an authenticated, low-privileged admin user to manipulate related records outside their intended authorization or tenancy boundary — a form of Insecure Direct Object Reference (IDOR). Affected versions are backpack/crud >= 6.0.0 < 6.8.15 and >= 7.0.0 < 7.0.47. The vulnerability was originally published on June 30, 2026, and added to the GitHub Advisory Database on August 20, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause (CWE-862) lies in the attachManyRelation logic within Backpack CRUD's relationship-saving flow. When processing submitted primary keys for HasMany or MorphMany fields, the code updated matching related records without verifying that those records already belonged to the current parent model or fell within the developer-defined relation scope. This is distinct from earlier fixes that scoped direct CRUD operations on the main entity — those protections did not extend to secondary models modified through relationship-saving logic. An attacker exploits this by submitting arbitrary related-record primary keys in a CRUD form POST request, causing Backpack to reassign, detach, null, or delete records belonging to other parents or tenants (GitHub Advisory, Security Advisory).

Successful exploitation allows an authenticated admin user with edit access to a CRUD entity to cause unauthorized changes to related records across authorization or tenancy boundaries. Concrete impacts include unauthorized reassignment of related records to a different parent or tenant, unauthorized detachment or removal of related records, and data integrity degradation in multi-tenant or permission-sensitive applications. There is no confidentiality or availability impact (no data disclosure or service disruption), but the high integrity impact can corrupt application data relationships in ways that are difficult to detect or reverse (GitHub Advisory).

No public exploit code, active in-the-wild exploitation, or threat actor attribution has been reported for CVE-2026-57570. Exploitation requires an authenticated admin account with edit access to a CRUD form that exposes an affected HasMany or MorphMany multiple-relation field, limiting the attack surface to privileged users. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry is currently available (GitHub Advisory).

1. Identify a vulnerable instance: Confirm the target application uses backpack/crud >= 6.0.0 < 6.8.15 or >= 7.0.0 < 7.0.47 and exposes a CRUD form with a HasMany or MorphMany multiple-selection relationship field.
2. Authenticate: Log in as a low-privileged admin user who has edit access to at least one CRUD entity with an affected relationship field.
3. Enumerate related record IDs: Identify primary keys of related records belonging to other parents or tenants (e.g., via the admin panel's list views, API responses, or sequential ID guessing).
4. Craft a malicious form submission: Intercept a legitimate CRUD create or update POST request (e.g., using Burp Suite) and modify the relationship field values to include primary keys of records owned by other parents or tenants.
5. Submit the request: Send the crafted request to the CRUD update endpoint. Backpack's attachManyRelation logic processes the submitted IDs without ownership validation, causing the targeted records to be reassigned, detached, nulled, or deleted relative to their original parent.
6. Verify impact: Confirm that the targeted related records have been re-parented or removed from their original owner, demonstrating unauthorized cross-tenant data manipulation (GitHub Advisory, Security Advisory).

• Logs: Laravel application logs showing CRUD update/create requests where submitted relationship field values contain primary keys not previously associated with the edited parent record; repeated form submissions to the same CRUD endpoint with varying relationship ID sets.
• Database: Unexpected changes to foreign key columns (e.g., parent_id set to null or a different value) on related model records; audit log entries showing related records reassigned to a different parent without a corresponding admin action on the original parent.
• Network: HTTP POST requests to Backpack CRUD update/create endpoints (e.g., /admin/{entity}/{id}/edit) containing relationship field arrays with IDs outside the expected range for the current parent's related records.

Upgrade backpack/crud to version 6.8.15 (for the v6 branch) or 7.0.47 (for the v7 branch), which scope relationship attach and detach operations to records valid for the current parent model and relation context (Release 6.8.15, Release 7.0.47). As a workaround for applications that cannot immediately upgrade, developers should add server-side validation of submitted relationship IDs to confirm they belong to the current parent before processing, and apply custom relation scopes or authorization checks within the CRUD configuration. Multi-tenant applications should treat this as high priority given the potential for cross-tenant data corruption (Security Advisory).

The vulnerability was reported by iaohkut-from-NightWolf-Team, remediated by developer pxpm, and coordinated by Backpack maintainer tabacitu. The fix was verified through an internal PHPUnit test against Backpack's Testbench fixtures, confirming that submitted relationship values are now constrained before related records are modified. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (GitHub Advisory).