CVE-2026-54176
Received Received - Intake

Authentication Bypass in Backpack CRUD via Email Change

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account's existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow after the original session expires, converting session compromise into persistent account takeover. The same mechanism permits an insider to set a personal recovery address before access is revoked. The separate password-change endpoint is not affected because it verifies old_password. This issue is fixed in versions 6.8.14 and 7.0.38.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54176
EUVD
EUVD-2026-77718

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
backpack crud to 6.8.14 (inc)
backpack crud 7.0.38
laravel_backpack crud From 6.0.0 (inc) to 6.8.14 (exc)
laravel_backpack crud 6.8.14
laravel_backpack crud From 7.0.0 (inc) to 7.0.38 (exc)
laravel_backpack crud 7.0.38

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-620 When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in backpack/crud allows an authenticated user to change their account recovery email without verifying their current password. This is due to a flaw in MyAccountController where email updates bypass password checks. An attacker with temporary access could change the email and later reset the password via recovery, leading to persistent account takeover. The issue affects versions 6.0.0 to 6.8.13 and 7.0.0 to 7.0.37.

Detection Guidance

To detect this vulnerability, check if your Laravel-Backpack/CRUD version is between 6.0.0-6.8.13 or 7.0.0-7.0.37. Run: composer show backpack/crud to verify the installed version. If vulnerable, inspect AccountInfoRequest.php for missing current_password validation during email updates.

Impact Analysis

If you use affected versions of backpack/crud, an attacker with brief unauthorized access could change your recovery email and later reset your password, taking over your account permanently. Insiders with access could also set a personal recovery email before losing access. The vulnerability allows session compromise to escalate into full account takeover.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding sensitive information. It undermines access controls and authentication mechanisms required by these regulations.

Mitigation Strategies

Update Laravel-Backpack/CRUD to versions 6.8.14 or later for v6, or 7.0.38 or later for v7. This adds current-password verification when changing authentication columns like email.

Alternatively, implement a verification link sent to the new email before applying changes as an additional security measure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54176. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart