VentureDrake Laravel CRM before version 2.4.0 contains an incorrect authorization flaw that permits authenticated administrators to assign any role, including the Owner role, by invoking Role::find without proper scoping. The flaw also enables deletion of users belonging to other teams through the unscoped UserIndex delete() method. This results in full administrative privileges and the ability to remove cross‑team users, compromising confidentiality and integrity of the platform.

All installations of VentureDrake Laravel CRM running a version earlier than 2.4.0 are susceptible. The vulnerability particularly affects systems where administrators have access to the user management interface and the Role::find API.

The flaw is scored with a CVSS of 7, indicating moderate severity. The EPSS score is < 1% (approximately 0.00637), indicating a very low but nonzero probability of exploitation, but the fact that the issue requires authenticated admin access and affects role assignment means that organizations may be able to exploit it hands‑on if internal threat actors or compromised admin credentials exist. The vulnerability is not listed in the CISA KEV catalog, yet the potential for privilege elevation warrants timely mitigation. Attackers would likely target any exposed user‑management endpoints that expose Role::find without proper scoping and can then delete users from other teams, giving them disruptive or destructive capabilities.