CVE-2026-57570: Laravel Backpack CRUD HasMany/MorphMany Relation Fields Allow Cross-tenant Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-42vx-43vc-x6pr",
  "modified" : "2026-08-20T18:42:31Z",
  "published" : "2026-08-20T18:42:31Z",
  "aliases" : [ "CVE-2026-57570" ],
  "summary" : "Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation",
  "details" : "## Vulnerability Details\n\nAffected area: HasMany / MorphMany relation handling during CRUD create and update operations  \nCWE: CWE-862 — Missing Authorization  \nSeverity: Medium  \nCVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\n\n### Summary\n\nBackpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations.\n\nWhen an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model.\n\nThis could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field.\n\n### Root Cause\n\nThe vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope.\n\nAs a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form.\n\nThis issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic.\n\n### Impact\n\nAn authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records.\n\nPossible impact includes:\n\n- Unauthorized reassignment of related records across users, parents, or tenants.\n- Unauthorized detachment or removal of related records.\n- Data integrity issues in multi-tenant or permission-sensitive applications.\n\nThe issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field.\n\n### Affected Conditions\n\nAn application may be affected when all of the following are true:\n\n- A Backpack CRUD form exposes a multiple-selection field for a HasMany or MorphMany relation.\n- The related model contains records that should not be attachable or removable by the current admin user.\n- The application relies on tenant, ownership, or authorization boundaries for those related records.\n- The application has not added its own additional validation or authorization checks around submitted relation values.\n\n### Recommended Fix\n\nBackpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context.\n\nThe fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs.\n\nApplications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels.\n\n### Verification\n\nThe issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures.\n\nThe test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check.\n\nAfter applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "backpack/crud"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "7.0.0"
      }, {
        "fixed" : "7.0.47"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "backpack/crud"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.0.0"
      }, {
        "fixed" : "6.8.15"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-42vx-43vc-x6pr"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Laravel-Backpack/CRUD"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.15"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.47"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-862" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-20T18:42:31Z",
    "nvd_published_at" : null
  }
}