Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110630VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment

Medium 6.5

In plain English

A medium-severity incorrect authorization in laravel-crm from venturedrake. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 49.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.

Affected products (as reported)

Vendor	Product	Versions
venturedrake	laravel-crm	0 – before 2.4.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

References

https://github.com/venturedrake/laravel-crm/issues/79 issue-tracking
Role::find on the submitted role at 2.3.0 technical-description
unscoped, unauthorized UserIndex::delete at 2.3.0 technical-description
https://github.com/venturedrake/laravel-crm/commit/d64b59fb9f7355e1be9951fbcc5f54ed715dc212 patch
https://github.com/venturedrake/laravel-crm/commit/27bd5081004913660ccb3e0181b351a2e4ded104 patch
laravel-crm 2.4.0 Release Notes release-notes
https://github.com/venturedrake/laravel-crm product
VulnCheck Advisory: VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment third-party-advisory