CVE-2026-54180

## Summary Backpack CRUD's list and read operations correctly apply any query scopes registered via `addClause()` / `addBaseClause()` (e.g. tenant isolation, user ownership). However, the **Update**, **Delete**, and **Reorder** operations bypassed these scopes, fetching records directly from the unscoped model query. An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths. Applications that rely on `addBaseClause` for row-level access control (multi-tenancy, per-user data isolation) are affected. ## Impact Any Backpack CRUD panel that uses `addBaseClause` or `addClause` to restrict which rows a user may access is affected on its write operations. An authenticated low-privilege user can modify or delete records belonging to other tenants / users. ## Patches Apply the fixed release for your major version: - **v6**: upgrade to **6.8.14** or later - **v7**: upgrade to **7.0.38** or later The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side. ## Workarounds If you cannot upgrade immediately, add explicit `Gate` / `Policy` checks in your `CrudController`'s `update()`, `destroy()`, and `reorder()` methods to verify the authenticated user is permitted to act on the resolved record. ## Credits Reported by Vishal Shukla ([@shukla304](https://github.com/shukla304)).

No confirmed active exploitation of CVE-2026-54180 has been reported, but organizations should still patch proactively.

Update to patched version: Panel 6.8.14.

CVE-2026-54180 has a CVSS v3.1 base score of 7.6 (HIGH).