CVE-2026-54175— backpack/crud: Unverified password change in MyAccountController via mass assignment
Quick assessment
Affected
Laravel-Backpack CRUD
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
为 Backpack 提供创建、读取、更新和删除（CRUD）功能，而 Backpack 是一组帮助用户构建自定义管理面板的 Laravel 包。在 6.8.11 和 7.0.34 版本之前，位于 中的 方法在处理 请求时，将 中的请求数据直接传递给用户模型，而没有将更新操作限制在 所接受的字段范围内。因此，拥有已认证 Backpack 会话的攻击者可以通过批量赋值（mass-assign）修改密码、认证列或部署环境中特有的可填充（fillable）属性。在默认的 Laravel 11 用户模型中，提交的明文密码会被
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Laravel-Backpack | CRUD | < 6.8.11 |
affected |
>= 7.0.0, < 7.0.34 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54175
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
backpack/crud: Unverified password change in MyAccountController via mass assignment
Source: CVE Program / CVE List V5
Vulnerability Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未经验证的口令修改
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Laravel-Backpack | CRUD | < 6.8.11 | - |
|
II. Public POCs for CVE-2026-54175
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54175
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54175 (4)
Vendor Advisories for CVE-2026-54175 (1)
Vendor Pages for CVE-2026-54175 (2)
-
🔗 Release 7.0.34 🌈 · Laravel-Backpack/CRUD · GitHub x_refsource_MISC
-
🔗 Release 6.8.11 🌈 · Laravel-Backpack/CRUD · GitHub x_refsource_MISC
Same Patch Batch · Laravel-Backpack · 2026-09-14 · 8 CVEs total
| CVE-2026-54178 | 8.1 HIGH | backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUpload |
| CVE-2026-54182 | 8.1 HIGH | backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host |
| CVE-2026-54180 | 7.6 HIGH | backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cr |
| CVE-2026-54177 | 6.6 MEDIUM | backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk up |
| CVE-2026-54176 | 6.5 MEDIUM | backpack/crud: MyAccountController allows changing the login email without a current-passw |
| CVE-2026-57570 | 6.5 MEDIUM | backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (I |
| CVE-2026-54181 | 5.4 MEDIUM | backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are |
IV. Related Vulnerabilities
Same product: CRUD
-
CVE-2026-54181
backpack/crud: Stored XSS in the color column — the `@if($co -
CVE-2026-54177
backpack/crud: HasUploadFields keeps the attacker-supplied f -
CVE-2026-54176
backpack/crud: MyAccountController allows changing the login -
CVE-2026-54180
backpack/crud: CRUD panel query scopes are not enforced on U -
CVE-2026-57570
backpack/crud: HasMany/MorphMany relation fields allow cross
Same vendor: Laravel-Backpack
-
CVE-2026-54181
backpack/crud: Stored XSS in the color column — the `@if($co -
CVE-2026-54177
backpack/crud: HasUploadFields keeps the attacker-supplied f -
CVE-2026-54176
backpack/crud: MyAccountController allows changing the login -
CVE-2026-54180
backpack/crud: CRUD panel query scopes are not enforced on U -
CVE-2026-57570
backpack/crud: HasMany/MorphMany relation fields allow cross
Same weakness: CWE-620
-
CVE-2026-86260
sfturing hosp_order Password Recovery CommonUserController.j -
CVE-2026-85591
phpMyFAQ before 4.1.8 Authentication Bypass via Unverified P -
CVE-2026-17599
Nexus Repository 3 - Unverified Onboarding State on change-a -
CVE-2026-15964
Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege -
CVE-2026-12692
Improper Authentication in Vimesoft's Enterprise Video Platf
V. Comments for CVE-2026-54175
No comments yet