CVE-2026-54175
moderateMass Assignment Account Takeover in Backpack for Laravel (backpack/crud)
A mass-assignment flaw in Backpack for Laravel's CRUD package (backpack/crud) lets an attacker with any authenticated Backpack admin session overwrite protected user attributes by submitting extra fields to POST /admin/edit-account-info. MyAccountController passes nearly all request data ($request->except(['_token'])) to the user model instead of only the fields validated by AccountInfoRequest, so attributes such as password and the authentication column can be set directly. On a default Laravel 11 user model a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the dedicated password-change route; changing the authentication email can also enable a later password-reset takeover. All 6.x releases before 6.8.11 and 7.0.x releases before 7.0.34 are affected (CVSS 3.1: 7.6, high; CWE-620). No public proof of concept is known and the issue is not in CISA's KEV catalog.
What to do: Upgrade backpack/crud to 6.8.11 or later on the 6.x line, or 7.0.34 or later on the 7.x line. Audit web/application logs for POST requests to /admin/edit-account-info containing unexpected parameters (e.g., password or email fields), and rotate credentials and review permission changes for any accounts modified that way. As defense in depth, verify the User model's fillable allowlist prevents password and authentication-column updates through this route, and enforce server-side validation of all submitted fields.
| Laravel-Backpack backpack/crud (Backpack for Laravel) | <6.8.11 |
| Laravel-Backpack backpack/crud (Backpack for Laravel) | >=7.0.0, <7.0.34 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34.
- Weakness
- CWE-620
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
In the news0 stories
No ingested article mentions this CVE yet.