CVE-2026-42569: Phpvms Laravel Importer Route Group Missing Auth

Laravel `Route::group` registers the legacy `/importer` endpoints without authentication or admin-authorization middleware. The route group only applies the `web` middleware (session + CSRF), which does not verify identity, so a remote unauthenticated attacker can invoke `ImporterController` actions (`@config`, `@dbtest`, `@run`, `@complete`) and trigger the

Provally CuratedPublic repositoryHighHigh confidenceVerifiedApache-2.0PHP
greprules fetch cve-2026-42569-phpvms-laravel-importer-route-group-missing-auth --engine opengrep

Description

Laravel `Route::group` registers the legacy `/importer` endpoints without authentication or admin-authorization middleware. The route group only applies the `web` middleware (session + CSRF), which does not verify identity, so a remote unauthenticated attacker can invoke `ImporterController` actions (`@config`, `@dbtest`, `@run`, `@complete`) and trigger the