THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-42vx-43vc-x6pr (medium) — Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

[GHSA] GHSA-42vx-43vc-x6pr (medium) — Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

medgithub_advisoriesPublished 2026-08-20

GHSA-42vx-43vc-x6pr Severity: medium CVE: CVE-2026-57570

Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

## Vulnerability Details

Affected area: HasMany / MorphMany relation handling during CRUD create and update operations CWE: CWE-862 — Missing Authorization Severity: Medium CVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:L

Indicators of compromise

CVE-2026-57570cve

Original source: https://github.com/advisories/GHSA-42vx-43vc-x6pr