PT-2026-80745 · Packagist · Backpack Crud

CVE-2026-54175

·

Published

2026-08-20

·

Updated

2026-08-20

CVSS v3.1

7.6

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Summary

The MyAccountController::postAccountInfoForm action bound to POST /admin/edit-account-info calls $this->guard()->user()->update($request->except([' token'])). Because the controller uses except([' token']) rather than $request->validated() or the restricted keys defined in AccountInfoRequest::validationData(), any column present in the user model's $fillable array is mass-assigned from the request, including password. Backpack ships a separate POST /admin/change-password route (postChangePasswordForm) that requires old password verification via ChangePasswordRequest::withValidator. The edit-account-info endpoint silently bypasses that security control.
For the default Laravel 11 AppModelsUser model — which Backpack's installer and documentation use as the canonical admin user model — $fillable is ['name','email','password']. The password cast is hashed, so a plaintext password=… form field is automatically hashed and persisted. Any attacker holding an authenticated Backpack session (session theft, stolen cookies, XSS, public-terminal residual session) can permanently take over the account by issuing one POST that includes password=<attacker value>, with no knowledge of the victim's current password. This converts time-limited, session-bound access into persistent account takeover.

Vulnerable code

src/app/Http/Controllers/MyAccountController.php:38
php
public function postAccountInfoForm(AccountInfoRequest $request)
{
  $result = $this->guard()->user()->update($request->except([' token']));
  ...
}
src/app/Http/Requests/AccountInfoRequest.php validationData() only narrows what gets validated (name, email column) — it does NOT narrow what is later saved.

Impact

  1. Persistent account takeover after session theft. An adversary holding any authenticated Backpack session cookie (XSS, malware, stolen device, shared workstation) can rewrite the victim's password and retain access indefinitely, even after the original session expires or the victim logs out. Without this bypass the equivalent action requires old password, which the adversary does not have.
  2. Email pivot for full takeover. The same handler permits unverified change of the authentication column (email by default). A hijacked session can change the email to one the attacker controls and then use Backpack's password-reset flow as a backup channel.
  3. Mass-assignment of any other $fillable attribute. In real deployments where the admin user model carries fields such as role id, is admin, team id, email verified at, two factor secret, etc., the same request mass-assigns those fields. This expands the impact to privilege escalation and 2FA disablement on apps that follow standard Laravel patterns of adding such columns to $fillable.

Fix recommendation

Replace $request->except([' token']) with an explicit allowlist that mirrors AccountInfoRequest::validationData():
php
public function postAccountInfoForm(AccountInfoRequest $request)
{
  $data = $request->only([backpack authentication column(), 'name']);
  $result = $this->guard()->user()->update($data);
  ...
}
This preserves change-password as the sole path for password mutation (which already enforces old password).

Coordinates

  • Repository: https://github.com/Laravel-Backpack/CRUD
  • Vulnerable file & line: src/app/Http/Controllers/MyAccountController.php:38 (release 6.8.10; master e7201c5)
  • Route: POST /admin/edit-account-info (default admin prefix; setup my account routes=true)
  • Verified against: backpack/crud 6.8.10, laravel/framework 11.x, PHP 8.4.7
— therawdev (responsible disclosure)
Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304)

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2026-54175
GHSA-XPV2-HRFC-HW62

Affected Products

Backpack Crud