backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query instead of the query configured through addClause() or addBaseClause(). An authenticated user who knows or guesses an out-of-scope record primary key can therefore modify, delete, or reorder records hidden by tenant, ownership, or other row-level access-control scopes. Applications that do not rely on CRUD query clauses for authorization are not affected by this specific bypass. The fix routes all three write operations through getModelWithCrudPanelQuery(), matching the scoped list and read behavior. This issue is fixed in versions 6.8.14 and 7.0.38.
Affected: Packagist: backpack/crud
## Summary
Backpack CRUD's list and read operations correctly apply any query scopes registered via `addClause()` / `addBaseClause()` (e.g. tenant isolation, user ownership). However, the **Update**, **Delete**, and **Reorder** operations bypassed these scopes, fetching records directly from the unscoped model query.
An authenticated user who knows or can guess a record's primary key could therefore update, delete, or reorder records that should be invisible to them — a classic IDOR on write paths.
Applications that rely on `addBaseClause` for row-level access control (multi-tenancy, per-user data isolation) are affected.
## Impact
Any Backpack CRUD panel that uses `addBaseClause` or `addClause` to restrict which rows a user may access is affected on its write operations. An authenticated low-privilege user can modify or delete records belonging to other tenants / users.
## Patches
Apply the fixed release for your major version:
- **v6**: upgrade to **6.8.14** or later - **v7**: upgrade to **7.0.38** or later
The fix ensures Update, Delete, and Reorder all resolve records through the same scoped query used by the read side.
## Workarounds
If you cannot upgrade immediately, add explicit `Gate` / `Policy` checks in your `CrudController`'s `update()`, `destroy()`, and `reorder()` methods to verify the authenticated user is permitted to act on the resolved record.
## Credits
Reported by Vishal Shukla ([@shukla304](https://github.com/shukla304)).