Summary
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation
Vulnerability Details
Affected area: HasMany / MorphMany relation handling during CRUD create and update operations
CWE: CWE-862, Missing Authorization
Severity: Medium
CVSS: 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Backpack CRUD contained an authorization issue in the way certain HasMany and MorphMany relationship fields were processed during create and update operations.
When an admin form allowed users to manage multiple related records, Backpack could update related model records based on submitted primary keys without sufficiently checking whether those records were eligible to be associated with the current parent model.
This could allow an authenticated, low-privileged admin user to affect related records outside the intended authorization or tenancy boundary, if the affected CRUD form exposed this type of relationship field.
Root Cause
The vulnerable logic processed submitted relationship values and updated matching related records without consistently limiting those updates to records that already belonged to the current parent model, or to records allowed by the developer-defined relation scope.
As a result, a user with permission to edit one parent record could potentially cause unrelated child records to be reassigned, detached, nulled, or deleted as a side effect of saving the form.
This issue is separate from earlier fixes that scoped direct CRUD operations on the main entity. Those protections covered the model being directly edited, but they did not fully cover secondary models modified through relationship-saving logic.
Affected Conditions
An application may be affected when all of the following are true:
- A Backpack CRUD form exposes a multiple-selection field for a HasMany or MorphMany relation.
- The related model contains records that should not be attachable or removable by the current admin user.
- The application relies on tenant, ownership, or authorization boundaries for those related records.
- The application has not added its own additional validation or authorization checks around submitted relation values.
Verification
The issue was confirmed through an internal PHPUnit test against Backpack’s existing Testbench fixtures.
The test demonstrated that, before the fix, a related record owned by one parent model could be reassigned to another parent model through the relationship-saving flow, without an explicit ownership or authorization check.
After applying the fix, submitted relationship values are constrained before related records are modified, preventing unauthorized reassignment or removal.
Impact
An authenticated admin user with access to an affected CRUD operation could potentially cause unauthorized changes to related records.
Possible impact includes:
- Unauthorized reassignment of related records across users, parents, or tenants.
- Unauthorized detachment or removal of related records.
- Data integrity issues in multi-tenant or permission-sensitive applications.
The issue requires an authenticated admin account with edit access to a CRUD entity that exposes an affected HasMany or MorphMany multiple-relation field.
The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.
CVE-2026-57570 has a CVSS score of 6.5 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (7.0.47, 6.8.15); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Backpack should scope relationship attach and detach operations so they only affect records that are valid for the current parent model and relation context.
The fix should ensure that related records are filtered through the relation’s intended query scope, ownership rules, or other developer-defined constraints before any update, detach, null, or delete operation occurs.
Applications using affected relationship fields should also validate submitted relation IDs server-side, especially in multi-tenant or permission-sensitive admin panels.
Frequently Asked Questions
- What is CVE-2026-57570? CVE-2026-57570 is a medium-severity missing authorization vulnerability in backpack/crud (composer), affecting versions >= 7.0.0, < 7.0.47. It is fixed in 7.0.47, 6.8.15. The application does not perform an authorization check before performing a sensitive operation.
- How severe is CVE-2026-57570? CVE-2026-57570 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of backpack/crud are affected by CVE-2026-57570? backpack/crud (composer) versions >= 7.0.0, < 7.0.47 is affected.
- Is there a fix for CVE-2026-57570? Yes. CVE-2026-57570 is fixed in 7.0.47, 6.8.15. Upgrade to this version or later.
- Is CVE-2026-57570 exploitable, and should I be worried? Whether CVE-2026-57570 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-57570 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-57570?
- Upgrade
backpack/crudto 7.0.47 or later - Upgrade
backpack/crudto 6.8.15 or later
- Upgrade