CVE-2026-110629 — VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action me…
Published: 2026-10-14 · CVSS: 7.1 · CVSS 4.0
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7