This vulnerability in VentureDrake Laravel CRM versions prior to 2.4.0 deactivates Spatie role restrictions on Livewire action methods. Authenticated users, even those with read‑only privileges, can trigger actions such as delete, win, lose or reopen on components like DealIndex, and can also access unguarded Activities and Products routes. The server-side code therefore permits unauthorized alteration of business data. The weakness is characterized as an access control flaw (CWE‑862).

Applications built with the VentureDrake Laravel CRM package that are running any version before 2.4.0 are affected. The issue manifests in the Livewire components and route definitions contained in the CRM’s core directories. Any deployment using the package for deal, quote, order, or invoice management is at risk.

The CVSS base score of 7.1 indicates a high impact when the logical conditions are met. EPSS data is not available, so the likelihood of exploitation cannot be quantified from public metrics, but the absence of a KEV listing does not reduce the threat. Attackers only need to be authenticated to the system; they do not require elevated privileges or external network exposure. Once authenticated, a read‑only user can alter critical business records. The lack of middleware checks and the exposed route endpoints make the vulnerability straightforward to exploit for anyone with valid user credentials.