Is CVE-2026-110630 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110630?

CVE-2026-110630 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-110630

Description

VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.