Venturedrake CVEs and Security Vulnerabilities

CVE-2026-110629

VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions

VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Venturedrake

Products

Laravel-crm

CVE-2026-110630

VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment

VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed