CVE-2026-54175
Received Received - Intake

Mass Assignment in Backpack CRUD

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54175
EUVD
EUVD-2026-77706

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
backpack crud to 6.8.11 (inc)
backpack crud to 7.0.34 (inc)
laravel_backpack crud to 6.8.11 (exc)
laravel_backpack crud to 7.0.34 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-620 When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a mass assignment issue in Laravel-Backpack/CRUD versions below 6.8.11 and 7.0.34. The MyAccountController::postAccountInfoForm method uses $request->except(['_token']) to update user data, allowing any field in the user model's $fillable array to be modified, including passwords. This bypasses security controls that require old password verification for password changes.

Detection Guidance

To detect this vulnerability, check if your Laravel-Backpack/CRUD version is below 6.8.11 or 7.0.34. Inspect MyAccountController.php for use of $request->except(['_token']) in postAccountInfoForm. Review server logs for POST requests to /admin/edit-account-info containing password or sensitive field modifications.

Impact Analysis

An attacker with an authenticated Backpack session can exploit this to change passwords without knowing the current password, leading to persistent account takeover. They can also modify sensitive fields like email, role_id, or two_factor_secret, enabling privilege escalation or disabling security controls.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by enabling unauthorized account takeover through password changes without old password verification. It allows attackers to modify sensitive fields like passwords, emails, or roles, potentially exposing personal data or protected health information. Compliance requires strict access controls and audit trails, which this flaw undermines by permitting mass assignment of sensitive attributes.

Mitigation Strategies

Immediately update Laravel-Backpack/CRUD to versions 6.8.11 or 7.0.34 or later. Replace $request->except(['_token']) with $request->validated() in MyAccountController.php. Review user accounts for unauthorized changes to passwords, emails, or roles. Ensure password change routes enforce old password verification.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54175. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart