[MEDIUM] Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

PKSA-1hj4-7f8v-mbzt CVE-2026-57570 GHSA-42vx-43vc-x6pr

Affected package: backpack/crud

Affected version: >=6.0.0,<6.8.15|>=7.0.0,<7.0.47

Reported by:
GitHub