[HIGH] Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

PKSA-s7xs-gg49-zwxc CVE-2026-54180 GHSA-vgmv-8xjc-6rch

Affected package: backpack/crud

Affected version: >=7.0.0,<7.0.38|>=6.0.0,<6.8.14

Reported by:
GitHub