Missing authorization in VentureDrake Laravel CRM Livewire actions
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization flaw (CWE-862) that lets authenticated users bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components such as DealIndex to modify deals, quotes, orders and invoices. An attacker needs low privileges and a valid account, and no user interaction is required.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| venturedrake | laravel-crm | before 2.4.0 | 2.4.0 | Patch available | CNA |
- laravel-crm Vendorventuredrake Affected before 2.4.0 Fixed in 2.4.0 Patch available CNA
Remediation
Upgrade venturedrake laravel-crm to version 2.4.0, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA laravel-crm (venturedrake) Fixed in 2.4.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
venturedrake laravel-crm 2.4.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-74124 Privilege escalation in VentureDrake Laravel CRM via unscoped role assignmentPriority LOW 32
Timeline
- 2026-10-14 Threatist record created from CVE-2026-110629
- 2026-10-14 Alias added: GHSA-h9jr-9j2x-qpfm
- 2026-10-15 CISA SSVC decision points changed
- 2026-10-15 Priority changed: MEDIUM → LOW
References
Patch 4
- Merge of PR #89: can: middleware on Activities and product routes
- https://github.com/venturedrake/laravel-crm/commit/cc41264eff5563f470984b8d2cfcc9ab4583c586
- https://github.com/venturedrake/laravel-crm/commit/049fc966029234a6d0f02b69efeabdb16e35bbb0
- https://github.com/venturedrake/laravel-crm/commit/78dbf4e41afe48def4037c69d5dd7a34820122c3
More venturedrake vulnerabilities
- TI-2026-74124 Privilege escalation in VentureDrake Laravel CRM via unscoped role assignment CVSS 4.0HIGH 7.0
Sources
- CVE-2026-110629 · CVE Program
- CVE-2026-110629 · NVD
- FIRST EPSS
- GHSA-h9jr-9j2x-qpfm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences