CVE-2026-110629
HIGH 7.1VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
Severe if exploited (CVSS 7.1), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.6%chance of exploitation in 30 days · 47th percentile
Impact if exploited
7.1CVSS 4.0 · HIGH
- ConfidentialityNone
- IntegrityHigh
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-862: Missing Authorization
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
References and research data (JSON)
All CVSS metrics
- HIGH 7.1 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - MEDIUM 6.5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - HIGH 7.1 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - MEDIUM 6.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
Patches & mitigations
- https://github.com/venturedrake/laravel-crm/commit/1a280cb22fc006f63fb96fe540dc4d651a8fb0a8 CVE record · VulnCheck · Updated 2026-10-14T14:17:03.868Z
NVD · CVE-2026-110629 · Updated 2026-10-16T19:18:44.867 - https://github.com/venturedrake/laravel-crm/commit/cc41264eff5563f470984b8d2cfcc9ab4583c586 CVE record · VulnCheck · Updated 2026-10-14T14:17:03.868Z
NVD · CVE-2026-110629 · Updated 2026-10-16T19:18:44.867 - https://github.com/venturedrake/laravel-crm/commit/049fc966029234a6d0f02b69efeabdb16e35bbb0 CVE record · VulnCheck · Updated 2026-10-14T14:17:03.868Z
NVD · CVE-2026-110629 · Updated 2026-10-16T19:18:44.867 - https://github.com/venturedrake/laravel-crm/commit/78dbf4e41afe48def4037c69d5dd7a34820122c3 CVE record · VulnCheck · Updated 2026-10-14T14:17:03.868Z
NVD · CVE-2026-110629 · Updated 2026-10-16T19:18:44.867 - https://github.com/venturedrake/laravel-crm/releases/tag/2.4.0 CVE record · VulnCheck · Updated 2026-10-14T14:17:03.868Z
NVD · CVE-2026-110629 · Updated 2026-10-16T19:18:44.867
Advisories
- https://www.vulncheck.com/advisories/venturedrake-laravel-crm-before-2.4.0-missing-authorization-via-livewire-actions CVE record · VulnCheck · Updated 2026-10-14T14:17:03.868Z
NVD · CVE-2026-110629 · Updated 2026-10-16T19:18:44.867 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101257 EUVD · EUVD-2026-101257
Technical & other
- https://github.com/venturedrake/laravel-crm/issues/79 CVE record · VulnCheck · Updated 2026-10-14T14:17:03.868Z
NVD · CVE-2026-110629 · Updated 2026-10-16T19:18:44.867 - https://github.com/venturedrake/laravel-crm/issues/80 CVE record · VulnCheck · Updated 2026-10-14T14:17:03.868Z
NVD · CVE-2026-110629 · Updated 2026-10-16T19:18:44.867 - https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Livewire/Deals/DealIndex.php#L125-L170 CVE record · VulnCheck · Updated 2026-10-14T14:17:03.868Z
NVD · CVE-2026-110629 · Updated 2026-10-16T19:18:44.867 - https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Http/routes.php#L573-L581 CVE record · VulnCheck · Updated 2026-10-14T14:17:03.868Z
NVD · CVE-2026-110629 · Updated 2026-10-16T19:18:44.867 - https://github.com/venturedrake/laravel-crm CVE record · VulnCheck · Updated 2026-10-14T14:17:03.868Z
NVD · CVE-2026-110629 · Updated 2026-10-16T19:18:44.867