Vulnerability-Lookup

CVE-2026-54175 (GCVE-0-2026-54175)

Vulnerability from cvelistv5 – Published: 2026-09-14 17:46 – Updated: 2026-09-14 18:12

Title

backpack/crud: Unverified password change in MyAccountController via mass assignment

Summary

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 18:12 UTC

CWE

CWE-620 - Unverified Password Change

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/Laravel-Backpack/CRUD/security…	x_refsource_CONFIRM
https://github.com/Laravel-Backpack/CRUD/pull/5980	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/pull/5981	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/0…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/f…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Laravel-Backpack	CRUD	Affected: < 6.8.11 Affected: >= 7.0.0, < 7.0.34	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54175",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T18:12:11.822672Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T18:12:27.005Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CRUD",
          "vendor": "Laravel-Backpack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.8.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.0.34"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request-\u003eexcept([\u0027_token\u0027]) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-620",
              "description": "CWE-620: Unverified Password Change",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:46:41.740Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/pull/5980",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/pull/5980"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/pull/5981",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/pull/5981"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34"
        }
      ],
      "source": {
        "advisory": "GHSA-xpv2-hrfc-hw62",
        "discovery": "UNKNOWN"
      },
      "title": "backpack/crud: Unverified password change in MyAccountController via mass assignment"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54175",
    "datePublished": "2026-09-14T17:46:41.740Z",
    "dateReserved": "2026-06-11T21:46:52.381Z",
    "dateUpdated": "2026-09-14T18:12:27.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54175\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-14T18:17:52.430\",\"lastModified\":\"2026-09-14T19:17:29.183\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request-\u003eexcept([\u0027_token\u0027]) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"Laravel-Backpack\",\"product\":\"CRUD\",\"versions\":[{\"version\":\"\u003c 6.8.11\",\"status\":\"affected\"},{\"version\":\"\u003e= 7.0.0, \u003c 7.0.34\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-14T18:12:11.822672Z\",\"id\":\"CVE-2026-54175\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-620\"}]}],\"references\":[{\"url\":\"https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/pull/5980\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/pull/5981\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54175\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-14T18:12:11.822672Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-14T18:12:22.010Z\"}}], \"cna\": {\"title\": \"backpack/crud: Unverified password change in MyAccountController via mass assignment\", \"source\": {\"advisory\": \"GHSA-xpv2-hrfc-hw62\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"Laravel-Backpack\", \"product\": \"CRUD\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 6.8.11\"}, {\"status\": \"affected\", \"version\": \"\u003e= 7.0.0, \u003c 7.0.34\"}]}], \"references\": [{\"url\": \"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/pull/5980\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/pull/5980\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/pull/5981\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/pull/5981\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34\", \"name\": \"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request-\u003eexcept([\u0027_token\u0027]) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-620\", \"description\": \"CWE-620: Unverified Password Change\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-14T17:46:41.740Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54175\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-14T18:12:27.005Z\", \"dateReserved\": \"2026-06-11T21:46:52.381Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-14T17:46:41.740Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-XPV2-HRFC-HW62

Vulnerability from github – Published: 2026-08-20 18:38 – Updated: 2026-08-20 18:38

Summary

Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Details

Summary

The MyAccountController::postAccountInfoForm action bound to POST /admin/edit-account-info calls $this->guard()->user()->update($request->except(['_token'])). Because the controller uses except(['_token']) rather than $request->validated() or the restricted keys defined in AccountInfoRequest::validationData(), any column present in the user model's $fillable array is mass-assigned from the request, including password. Backpack ships a separate POST /admin/change-password route (postChangePasswordForm) that requires old_password verification via ChangePasswordRequest::withValidator. The edit-account-info endpoint silently bypasses that security control.

For the default Laravel 11 App\Models\User model — which Backpack's installer and documentation use as the canonical admin user model — $fillable is ['name','email','password']. The password cast is hashed, so a plaintext password=… form field is automatically hashed and persisted. Any attacker holding an authenticated Backpack session (session theft, stolen cookies, XSS, public-terminal residual session) can permanently take over the account by issuing one POST that includes password=<attacker_value>, with no knowledge of the victim's current password. This converts time-limited, session-bound access into persistent account takeover.

Vulnerable code

src/app/Http/Controllers/MyAccountController.php:38

public function postAccountInfoForm(AccountInfoRequest $request)
{
    $result = $this->guard()->user()->update($request->except(['_token']));
    ...
}

src/app/Http/Requests/AccountInfoRequest.php validationData() only narrows what gets validated (name, email column) — it does NOT narrow what is later saved.

Impact

Persistent account takeover after session theft. An adversary holding any authenticated Backpack session cookie (XSS, malware, stolen device, shared workstation) can rewrite the victim's password and retain access indefinitely, even after the original session expires or the victim logs out. Without this bypass the equivalent action requires old_password, which the adversary does not have.
Email pivot for full takeover. The same handler permits unverified change of the authentication column (email by default). A hijacked session can change the email to one the attacker controls and then use Backpack's password-reset flow as a backup channel.
Mass-assignment of any other $fillable attribute. In real deployments where the admin user model carries fields such as role_id, is_admin, team_id, email_verified_at, two_factor_secret, etc., the same request mass-assigns those fields. This expands the impact to privilege escalation and 2FA disablement on apps that follow standard Laravel patterns of adding such columns to $fillable.

Fix recommendation

Replace $request->except(['_token']) with an explicit allowlist that mirrors AccountInfoRequest::validationData():

public function postAccountInfoForm(AccountInfoRequest $request)
{
    $data = $request->only([backpack_authentication_column(), 'name']);
    $result = $this->guard()->user()->update($data);
    ...
}

This preserves change-password as the sole path for password mutation (which already enforces old_password).

Coordinates

Repository: https://github.com/Laravel-Backpack/CRUD
Vulnerable file & line: src/app/Http/Controllers/MyAccountController.php:38 (release 6.8.10; master e7201c5)
Route: POST /admin/edit-account-info (default admin prefix; setup_my_account_routes=true)
Verified against: backpack/crud 6.8.10, laravel/framework 11.x, PHP 8.4.7

— therawdev (responsible disclosure)

Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304)

Severity

7.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.8.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0-alpha.1"
            },
            {
              "fixed": "7.0.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54175"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-620"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:38:26Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `MyAccountController::postAccountInfoForm` action bound to `POST /admin/edit-account-info` calls `$this-\u003eguard()-\u003euser()-\u003eupdate($request-\u003eexcept([\u0027_token\u0027]))`. Because the controller uses `except([\u0027_token\u0027])` rather than `$request-\u003evalidated()` or the restricted keys defined in `AccountInfoRequest::validationData()`, **any column present in the user model\u0027s `$fillable` array is mass-assigned from the request**, including `password`. Backpack ships a separate `POST /admin/change-password` route (`postChangePasswordForm`) that requires `old_password` verification via `ChangePasswordRequest::withValidator`. The `edit-account-info` endpoint silently bypasses that security control.\n\nFor the default Laravel 11 `App\\Models\\User` model \u2014 which Backpack\u0027s installer and documentation use as the canonical admin user model \u2014 `$fillable` is `[\u0027name\u0027,\u0027email\u0027,\u0027password\u0027]`. The `password` cast is `hashed`, so a plaintext `password=\u2026` form field is automatically hashed and persisted. Any attacker holding an authenticated Backpack session (session theft, stolen cookies, XSS, public-terminal residual session) can permanently take over the account by issuing one POST that includes `password=\u003cattacker_value\u003e`, with no knowledge of the victim\u0027s current password. This converts time-limited, session-bound access into persistent account takeover.\n\n## Vulnerable code\n\n`src/app/Http/Controllers/MyAccountController.php:38`\n\n```php\npublic function postAccountInfoForm(AccountInfoRequest $request)\n{\n    $result = $this-\u003eguard()-\u003euser()-\u003eupdate($request-\u003eexcept([\u0027_token\u0027]));\n    ...\n}\n```\n\n`src/app/Http/Requests/AccountInfoRequest.php` `validationData()` only narrows what gets validated (`name`, email column) \u2014 it does NOT narrow what is later saved.\n\n## Impact\n\n1. **Persistent account takeover after session theft.** An adversary holding any authenticated Backpack session cookie (XSS, malware, stolen device, shared workstation) can rewrite the victim\u0027s password and retain access indefinitely, even after the original session expires or the victim logs out. Without this bypass the equivalent action requires `old_password`, which the adversary does not have.\n2. **Email pivot for full takeover.** The same handler permits unverified change of the authentication column (`email` by default). A hijacked session can change the email to one the attacker controls and then use Backpack\u0027s password-reset flow as a backup channel.\n3. **Mass-assignment of any other `$fillable` attribute.** In real deployments where the admin user model carries fields such as `role_id`, `is_admin`, `team_id`, `email_verified_at`, `two_factor_secret`, etc., the same request mass-assigns those fields. This expands the impact to privilege escalation and 2FA disablement on apps that follow standard Laravel patterns of adding such columns to `$fillable`.\n\n## Fix recommendation\n\nReplace `$request-\u003eexcept([\u0027_token\u0027])` with an explicit allowlist that mirrors `AccountInfoRequest::validationData()`:\n\n```php\npublic function postAccountInfoForm(AccountInfoRequest $request)\n{\n    $data = $request-\u003eonly([backpack_authentication_column(), \u0027name\u0027]);\n    $result = $this-\u003eguard()-\u003euser()-\u003eupdate($data);\n    ...\n}\n```\n\nThis preserves `change-password` as the sole path for password mutation (which already enforces `old_password`).\n\n## Coordinates\n\n- Repository: https://github.com/Laravel-Backpack/CRUD\n- Vulnerable file \u0026 line: `src/app/Http/Controllers/MyAccountController.php:38` (release 6.8.10; master `e7201c5`)\n- Route: `POST /admin/edit-account-info` (default admin prefix; `setup_my_account_routes=true`)\n- Verified against: `backpack/crud 6.8.10`, `laravel/framework 11.x`, PHP 8.4.7\n\n\u2014 therawdev (responsible disclosure)\n\nReported by AI Agent sechub.dev and Vishal Shukla (@shukla304)",
  "id": "GHSA-xpv2-hrfc-hw62",
  "modified": "2026-08-20T18:38:26Z",
  "published": "2026-08-20T18:38:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5980"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5981"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Laravel-Backpack/CRUD"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-54175 (GCVE-0-2026-54175)

GHSA-XPV2-HRFC-HW62

Summary

Vulnerable code

Impact

Fix recommendation

Coordinates

Tags

Sightings

Nomenclature