Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck
CVE-2026-110629VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions
Medium 6.5
In plain English
A medium-severity missing authorization in laravel-crm from venturedrake. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Official description
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| venturedrake | laravel-crm | 0 – before 2.4.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/venturedrake/laravel-crm/issues/79 issue-tracking
- https://github.com/venturedrake/laravel-crm/issues/80 issue-tracking
- DealIndex actions with no authorization at 2.3.0 technical-description
- Activities routes with auth only at 2.3.0 technical-description
- Merge of PR #89: can: middleware on Activities and product routes patch
- https://github.com/venturedrake/laravel-crm/commit/cc41264eff5563f470984b8d2cfcc9ab4583c586 patch
- https://github.com/venturedrake/laravel-crm/commit/049fc966029234a6d0f02b69efeabdb16e35bbb0 patch
- https://github.com/venturedrake/laravel-crm/commit/78dbf4e41afe48def4037c69d5dd7a34820122c3 patch
- laravel-crm 2.4.0 Release Notes release-notes
- https://github.com/venturedrake/laravel-crm product
- VulnCheck Advisory: VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions third-party-advisory