CVE-2026-54176 Details
Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account's existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow after the original session expires, converting session compromise into persistent account takeover. The same mechanism permits an insider to set a personal recovery address before access is revoked. The separate password-change endpoint is not affected because it verifies old_password. This issue is fixed in versions 6.8.14 and 7.0.38.
A vulnerability in the Backpack CRUD package for Laravel allows authenticated users to change the account recovery email without verifying their current password. This issue is present in versions 6.0.0 prior to 6.8.14 and 7.0.0 prior to 7.0.38. The vulnerability arises because the 'postAccountInfoForm' method in 'MyAccountController' accepts 'AccountInfoRequest' updates to the authentication column (defaulting to email) without password verification. As a result, an attacker with a temporary authenticated session can alter the recovery email and exploit the password reset process after the session expires, leading to unauthorized account access. This flaw can also be misused by an insider to set a personal recovery email before leaving the organization.
Users can update to Backpack CRUD versions 6.8.14 or 7.0.38, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969 | [email protected] | Source CodeVendor |
| https://github.com/Laravel-Backpack/CRUD/commit/8ab94543d880b03c1189acb96b78186323c62a0b | [email protected] | Source CodeVendor |
| https://github.com/Laravel-Backpack/CRUD/pull/5990 | [email protected] | Issue TrackingVendor |
| https://github.com/Laravel-Backpack/CRUD/pull/5994 | [email protected] | Issue TrackingVendor |
| https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14 | [email protected] | Release NotesVendor |
| https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38 | [email protected] | Release NotesVendor |
| https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-9fw9-8c49-qch8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-620 | Unverified Password Change | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Backpack CRUD | >= 6.0.0, < 6.8.14 (semver) >= 7.0.0, < 7.0.38 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |