Vulnerability-Lookup

CVE-2026-54175 (GCVE-0-2026-54175)

Vulnerability from cvelistv5 – Published: 2026-09-14 17:46 – Updated: 2026-09-14 18:12

Title

backpack/crud: Unverified password change in MyAccountController via mass assignment

Summary

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 18:12 UTC

CWE

CWE-620 - Unverified Password Change

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7798 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/Laravel-Backpack/CRUD/security…	x_refsource_CONFIRM
https://github.com/Laravel-Backpack/CRUD/pull/5980	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/pull/5981	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/0…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/f…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Laravel-Backpack	CRUD	Affected: < 6.8.11 Affected: >= 7.0.0, < 7.0.34	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54175",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T18:12:11.822672Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T18:12:27.005Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CRUD",
          "vendor": "Laravel-Backpack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.8.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.0.34"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request-\u003eexcept([\u0027_token\u0027]) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-620",
              "description": "CWE-620: Unverified Password Change",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:46:41.740Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/pull/5980",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/pull/5980"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/pull/5981",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/pull/5981"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34"
        }
      ],
      "source": {
        "advisory": "GHSA-xpv2-hrfc-hw62",
        "discovery": "UNKNOWN"
      },
      "title": "backpack/crud: Unverified password change in MyAccountController via mass assignment"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54175",
    "datePublished": "2026-09-14T17:46:41.740Z",
    "dateReserved": "2026-06-11T21:46:52.381Z",
    "dateUpdated": "2026-09-14T18:12:27.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54175",
      "date": "2026-11-10",
      "epss": "0.00551",
      "percentile": "0.46429"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "CRUD",
                "vendor": "Laravel-Backpack",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 6.8.11"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 7.0.0, \u003c 7.0.34"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request-\u003eexcept([\u0027_token\u0027]) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34."
          }
        ],
        "id": "CVE-2026-54175",
        "lastModified": "2026-09-30T19:57:08.043",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54175",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T18:12:11.822672Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-14T18:17:52.430",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Laravel-Backpack/CRUD/pull/5980"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Laravel-Backpack/CRUD/pull/5981"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-620"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-54175",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-14T18:12:11.822672Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-14T18:12:22.010Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "CRUD",
              "vendor": "Laravel-Backpack",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 6.8.11"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 7.0.0, \u003c 7.0.34"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request-\u003eexcept([\u0027_token\u0027]) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-620",
                  "description": "CWE-620: Unverified Password Change",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-14T17:46:41.740Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62"
            },
            {
              "name": "https://github.com/Laravel-Backpack/CRUD/pull/5980",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Laravel-Backpack/CRUD/pull/5980"
            },
            {
              "name": "https://github.com/Laravel-Backpack/CRUD/pull/5981",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Laravel-Backpack/CRUD/pull/5981"
            },
            {
              "name": "https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7"
            },
            {
              "name": "https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91"
            },
            {
              "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11"
            },
            {
              "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34"
            }
          ],
          "source": {
            "advisory": "GHSA-xpv2-hrfc-hw62",
            "discovery": "UNKNOWN"
          },
          "title": "backpack/crud: Unverified password change in MyAccountController via mass assignment"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-54175",
        "datePublished": "2026-09-14T17:46:41.740Z",
        "dateReserved": "2026-06-11T21:46:52.381Z",
        "dateUpdated": "2026-09-14T18:12:27.005Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54175

Vulnerability from fkie_nvd - Published: 2026-09-14 18:17 - Updated: 2026-09-30 19:57

Severity

7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/pull/5980
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/pull/5981
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34
	security-advisories@github.com	https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "CRUD",
          "vendor": "Laravel-Backpack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.8.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.0.34"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request-\u003eexcept([\u0027_token\u0027]) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34."
    }
  ],
  "id": "CVE-2026-54175",
  "lastModified": "2026-09-30T19:57:08.043",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54175",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-14T18:12:11.822672Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T18:17:52.430",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5980"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5981"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-620"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-XPV2-HRFC-HW62

Vulnerability from github – Published: 2026-08-20 18:38 – Updated: 2026-08-20 18:38

Summary

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Details

Summary

The MyAccountController::postAccountInfoForm action bound to POST /admin/edit-account-info calls $this->guard()->user()->update($request->except(['_token'])). Because the controller uses except(['_token']) rather than $request->validated() or the restricted keys defined in AccountInfoRequest::validationData(), any column present in the user model's $fillable array is mass-assigned from the request, including password. Backpack ships a separate POST /admin/change-password route (postChangePasswordForm) that requires old_password verification via ChangePasswordRequest::withValidator. The edit-account-info endpoint silently bypasses that security control.

For the default Laravel 11 App\Models\User model — which Backpack's installer and documentation use as the canonical admin user model — $fillable is ['name','email','password']. The password cast is hashed, so a plaintext password=… form field is automatically hashed and persisted. Any attacker holding an authenticated Backpack session (session theft, stolen cookies, XSS, public-terminal residual session) can permanently take over the account by issuing one POST that includes password=<attacker_value>, with no knowledge of the victim's current password. This converts time-limited, session-bound access into persistent account takeover.

Vulnerable code

src/app/Http/Controllers/MyAccountController.php:38

public function postAccountInfoForm(AccountInfoRequest $request)
{
    $result = $this->guard()->user()->update($request->except(['_token']));
    ...
}

src/app/Http/Requests/AccountInfoRequest.php validationData() only narrows what gets validated (name, email column) — it does NOT narrow what is later saved.

Impact

Persistent account takeover after session theft. An adversary holding any authenticated Backpack session cookie (XSS, malware, stolen device, shared workstation) can rewrite the victim's password and retain access indefinitely, even after the original session expires or the victim logs out. Without this bypass the equivalent action requires old_password, which the adversary does not have.
Email pivot for full takeover. The same handler permits unverified change of the authentication column (email by default). A hijacked session can change the email to one the attacker controls and then use Backpack's password-reset flow as a backup channel.
Mass-assignment of any other $fillable attribute. In real deployments where the admin user model carries fields such as role_id, is_admin, team_id, email_verified_at, two_factor_secret, etc., the same request mass-assigns those fields. This expands the impact to privilege escalation and 2FA disablement on apps that follow standard Laravel patterns of adding such columns to $fillable.

Fix recommendation

Replace $request->except(['_token']) with an explicit allowlist that mirrors AccountInfoRequest::validationData():

public function postAccountInfoForm(AccountInfoRequest $request)
{
    $data = $request->only([backpack_authentication_column(), 'name']);
    $result = $this->guard()->user()->update($data);
    ...
}

This preserves change-password as the sole path for password mutation (which already enforces old_password).

Coordinates

Repository: https://github.com/Laravel-Backpack/CRUD
Vulnerable file & line: src/app/Http/Controllers/MyAccountController.php:38 (release 6.8.10; master e7201c5)
Route: POST /admin/edit-account-info (default admin prefix; setup_my_account_routes=true)
Verified against: backpack/crud 6.8.10, laravel/framework 11.x, PHP 8.4.7

— therawdev (responsible disclosure)

Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304)

Severity

7.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.8.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0-alpha.1"
            },
            {
              "fixed": "7.0.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54175"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:38:26Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `MyAccountController::postAccountInfoForm` action bound to `POST /admin/edit-account-info` calls `$this-\u003eguard()-\u003euser()-\u003eupdate($request-\u003eexcept([\u0027_token\u0027]))`. Because the controller uses `except([\u0027_token\u0027])` rather than `$request-\u003evalidated()` or the restricted keys defined in `AccountInfoRequest::validationData()`, **any column present in the user model\u0027s `$fillable` array is mass-assigned from the request**, including `password`. Backpack ships a separate `POST /admin/change-password` route (`postChangePasswordForm`) that requires `old_password` verification via `ChangePasswordRequest::withValidator`. The `edit-account-info` endpoint silently bypasses that security control.\n\nFor the default Laravel 11 `App\\Models\\User` model \u2014 which Backpack\u0027s installer and documentation use as the canonical admin user model \u2014 `$fillable` is `[\u0027name\u0027,\u0027email\u0027,\u0027password\u0027]`. The `password` cast is `hashed`, so a plaintext `password=\u2026` form field is automatically hashed and persisted. Any attacker holding an authenticated Backpack session (session theft, stolen cookies, XSS, public-terminal residual session) can permanently take over the account by issuing one POST that includes `password=\u003cattacker_value\u003e`, with no knowledge of the victim\u0027s current password. This converts time-limited, session-bound access into persistent account takeover.\n\n## Vulnerable code\n\n`src/app/Http/Controllers/MyAccountController.php:38`\n\n```php\npublic function postAccountInfoForm(AccountInfoRequest $request)\n{\n    $result = $this-\u003eguard()-\u003euser()-\u003eupdate($request-\u003eexcept([\u0027_token\u0027]));\n    ...\n}\n```\n\n`src/app/Http/Requests/AccountInfoRequest.php` `validationData()` only narrows what gets validated (`name`, email column) \u2014 it does NOT narrow what is later saved.\n\n## Impact\n\n1. **Persistent account takeover after session theft.** An adversary holding any authenticated Backpack session cookie (XSS, malware, stolen device, shared workstation) can rewrite the victim\u0027s password and retain access indefinitely, even after the original session expires or the victim logs out. Without this bypass the equivalent action requires `old_password`, which the adversary does not have.\n2. **Email pivot for full takeover.** The same handler permits unverified change of the authentication column (`email` by default). A hijacked session can change the email to one the attacker controls and then use Backpack\u0027s password-reset flow as a backup channel.\n3. **Mass-assignment of any other `$fillable` attribute.** In real deployments where the admin user model carries fields such as `role_id`, `is_admin`, `team_id`, `email_verified_at`, `two_factor_secret`, etc., the same request mass-assigns those fields. This expands the impact to privilege escalation and 2FA disablement on apps that follow standard Laravel patterns of adding such columns to `$fillable`.\n\n## Fix recommendation\n\nReplace `$request-\u003eexcept([\u0027_token\u0027])` with an explicit allowlist that mirrors `AccountInfoRequest::validationData()`:\n\n```php\npublic function postAccountInfoForm(AccountInfoRequest $request)\n{\n    $data = $request-\u003eonly([backpack_authentication_column(), \u0027name\u0027]);\n    $result = $this-\u003eguard()-\u003euser()-\u003eupdate($data);\n    ...\n}\n```\n\nThis preserves `change-password` as the sole path for password mutation (which already enforces `old_password`).\n\n## Coordinates\n\n- Repository: https://github.com/Laravel-Backpack/CRUD\n- Vulnerable file \u0026 line: `src/app/Http/Controllers/MyAccountController.php:38` (release 6.8.10; master `e7201c5`)\n- Route: `POST /admin/edit-account-info` (default admin prefix; `setup_my_account_routes=true`)\n- Verified against: `backpack/crud 6.8.10`, `laravel/framework 11.x`, PHP 8.4.7\n\n\u2014 therawdev (responsible disclosure)\n\nReported by AI Agent sechub.dev and Vishal Shukla (@shukla304)",
  "id": "GHSA-xpv2-hrfc-hw62",
  "modified": "2026-08-20T18:38:26Z",
  "published": "2026-08-20T18:38:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5980"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5981"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Laravel-Backpack/CRUD"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54175 (GCVE-0-2026-54175)

FKIE_CVE-2026-54175

GHSA-XPV2-HRFC-HW62

Summary

Vulnerable code

Impact

Fix recommendation

Coordinates

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour