{"id":"CVE-2026-54175","title":"backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels","summary":"backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm…","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","cwe":["CWE-620"],"vendor":"Laravel-Backpack","product":"CRUD","affected":["CRUD < 6.8.11","CRUD >= 7.0.0, < 7.0.34"],"patched":["backpack/crud 6.8.11","backpack/crud 7.0.34"],"published":"2026-09-14","updated":"2026-09-14","sourceUpdated":"2026-09-14T19:17:29.183","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54175","references":[{"url":"https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7","label":"security-advisories@github.com"},{"url":"https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91","label":"security-advisories@github.com"},{"url":"https://github.com/Laravel-Backpack/CRUD/pull/5980","label":"security-advisories@github.com"},{"url":"https://github.com/Laravel-Backpack/CRUD/pull/5981","label":"security-advisories@github.com"},{"url":"https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11","label":"security-advisories@github.com"},{"url":"https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34","label":"security-advisories@github.com"},{"url":"https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-xpv2-hrfc-hw62"}],"tags":["nvd","cve.org","ghsa","composer"],"aliases":["GHSA-xpv2-hrfc-hw62"],"ecosystem":"composer","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T18:12:11.822672Z"},"ingestedAt":"2026-08-20T18:59:54.951Z","epss":0.00383,"epssPercentile":0.3209,"slug":"CVE-2026-54175","body":"## Overview\n\nbackpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54175)\n\nAffected packages:\n\n- `backpack/crud < 6.8.11`\n- `backpack/crud >= 7.0.0-alpha.1, < 7.0.34`\n\nPatched in:\n\n- `backpack/crud 6.8.11`\n- `backpack/crud 7.0.34`\n\nSource: https://github.com/advisories/GHSA-xpv2-hrfc-hw62","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}