Vulnerability-Lookup

CVE-2026-54176 (GCVE-0-2026-54176)

Vulnerability from cvelistv5 – Published: 2026-09-14 17:53 – Updated: 2026-09-14 17:53

Title

backpack/crud: MyAccountController allows changing the login email without a current-password check

Summary

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account's existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow after the original session expires, converting session compromise into persistent account takeover. The same mechanism permits an insider to set a personal recovery address before access is revoked. The separate password-change endpoint is not affected because it verifies old_password. This issue is fixed in versions 6.8.14 and 7.0.38.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-287 - Improper Authentication
CWE-620 - Unverified Password Change

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/Laravel-Backpack/CRUD/security…	x_refsource_CONFIRM
https://github.com/Laravel-Backpack/CRUD/pull/5990	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/pull/5994	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/7…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/commit/8…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC
https://github.com/Laravel-Backpack/CRUD/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Laravel-Backpack	CRUD	Affected: >= 6.0.0, < 6.8.14 Affected: >= 7.0.0, < 7.0.38	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CRUD",
          "vendor": "Laravel-Backpack",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.8.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.0.38"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account\u0027s existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow after the original session expires, converting session compromise into persistent account takeover. The same mechanism permits an insider to set a personal recovery address before access is revoked. The separate password-change endpoint is not affected because it verifies old_password. This issue is fixed in versions 6.8.14 and 7.0.38."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-620",
              "description": "CWE-620: Unverified Password Change",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:53:25.835Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-9fw9-8c49-qch8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-9fw9-8c49-qch8"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/pull/5990",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/pull/5990"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/pull/5994",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/pull/5994"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/commit/8ab94543d880b03c1189acb96b78186323c62a0b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/commit/8ab94543d880b03c1189acb96b78186323c62a0b"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"
        },
        {
          "name": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"
        }
      ],
      "source": {
        "advisory": "GHSA-9fw9-8c49-qch8",
        "discovery": "UNKNOWN"
      },
      "title": "backpack/crud: MyAccountController allows changing the login email without a current-password check"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54176",
    "datePublished": "2026-09-14T17:53:25.835Z",
    "dateReserved": "2026-06-11T21:46:52.381Z",
    "dateUpdated": "2026-09-14T17:53:25.835Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54176\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-14T18:17:52.593\",\"lastModified\":\"2026-09-14T18:17:52.593\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"backpack/crud provides Create, Read, Update \u0026 Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account\u0027s existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow after the original session expires, converting session compromise into persistent account takeover. The same mechanism permits an insider to set a personal recovery address before access is revoked. The separate password-change endpoint is not affected because it verifies old_password. This issue is fixed in versions 6.8.14 and 7.0.38.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"Laravel-Backpack\",\"product\":\"CRUD\",\"versions\":[{\"version\":\"\u003e= 6.0.0, \u003c 6.8.14\",\"status\":\"affected\"},{\"version\":\"\u003e= 7.0.0, \u003c 7.0.38\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"},{\"lang\":\"en\",\"value\":\"CWE-620\"}]}],\"references\":[{\"url\":\"https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/commit/8ab94543d880b03c1189acb96b78186323c62a0b\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/pull/5990\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/pull/5994\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-9fw9-8c49-qch8\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

GHSA-9FW9-8C49-QCH8

Vulnerability from github – Published: 2026-08-20 18:38 – Updated: 2026-08-20 18:38

Summary

Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check

Details

Summary

MyAccountController::postAccountInfoForm allows an authenticated user to update the authentication column (default: email) without verifying their current password. Because email is the account-recovery anchor, this enables account takeover after the attacker's session ends: the new email address can be used to request a password reset from outside the system.

The password-change endpoint in the same controller correctly requires old_password verification, so the gap is asymmetric.

Details

The postAccountInfoForm action passes $request->validated() directly to $user->update(). The AccountInfoRequest whitelists the authentication column (email by default) with no ownership challenge. Contrast this with ChangePasswordRequest, which uses Hash::check against the stored password before allowing any change.

Scenarios where this is exploitable include: - A brief unauthorized session (e.g. unattended workstation, XSS in the admin panel) - An insider/offboarding case where a departing admin sets a personal email address before access is revoked, then resets the password after leaving

Patch

Fixed in #5990 — the authentication column is now protected by a current_password check (mirroring ChangePasswordRequest) whenever its value changes.

A stronger mitigation — sending a verification link to the new address before persisting the change — can be layered on top using Laravel's MustVerifyEmail flow.

Affected versions

All versions prior to 6.8.14 / 7.0.38.

Fixed versions

6.x: 6.8.14
7.x: 7.0.38

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.8.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "backpack/crud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.38"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54176"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-620"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:38:30Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`MyAccountController::postAccountInfoForm` allows an authenticated user to update\nthe authentication column (default: `email`) without verifying their current password.\nBecause email is the account-recovery anchor, this enables account takeover after\nthe attacker\u0027s session ends: the new email address can be used to request a password\nreset from outside the system.\n\nThe password-change endpoint in the same controller correctly requires `old_password`\nverification, so the gap is asymmetric.\n\n## Details\n\nThe `postAccountInfoForm` action passes `$request-\u003evalidated()` directly to\n`$user-\u003eupdate()`. The `AccountInfoRequest` whitelists the authentication column\n(`email` by default) with no ownership challenge. Contrast this with\n`ChangePasswordRequest`, which uses `Hash::check` against the stored password before\nallowing any change.\n\nScenarios where this is exploitable include:\n- A brief unauthorized session (e.g. unattended workstation, XSS in the admin panel)\n- An insider/offboarding case where a departing admin sets a personal email address\n  before access is revoked, then resets the password after leaving\n\n## Patch\n\nFixed in [#5990](https://github.com/Laravel-Backpack/CRUD/pull/5990) \u2014 the\nauthentication column is now protected by a `current_password` check (mirroring\n`ChangePasswordRequest`) whenever its value changes.\n\nA stronger mitigation \u2014 sending a verification link to the new address before\npersisting the change \u2014 can be layered on top using Laravel\u0027s `MustVerifyEmail` flow.\n\n## Affected versions\n\nAll versions prior to 6.8.14 / 7.0.38.\n\n## Fixed versions\n\n- 6.x: 6.8.14\n- 7.x: 7.0.38",
  "id": "GHSA-9fw9-8c49-qch8",
  "modified": "2026-08-20T18:38:30Z",
  "published": "2026-08-20T18:38:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-9fw9-8c49-qch8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5990"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Laravel-Backpack/CRUD"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-54176 (GCVE-0-2026-54176)

GHSA-9FW9-8C49-QCH8

Summary

Details

Patch

Affected versions

Fixed versions

Tags

Sightings

Nomenclature