---
id: CVE-2026-54175
title: >-
  backpack/crud provides Create, Read, Update & Delete (CRUD) functions for
  Backpack, a collection of Laravel packages that help users build custom
  administration panels
summary: >-
  backpack/crud provides Create, Read, Update & Delete (CRUD) functions for
  Backpack, a collection of Laravel packages that help users build custom
  administration panels. Prior to 6.8.11 and 7.0.34,
  MyAccountController::postAccountInfoForm…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L'
cwe:
  - CWE-620
vendor: Laravel-Backpack
product: CRUD
affected:
  - CRUD < 6.8.11
  - 'CRUD >= 7.0.0, < 7.0.34'
patched:
  - backpack/crud 6.8.11
  - backpack/crud 7.0.34
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T19:17:29.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54175'
references:
  - url: >-
      https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7
    label: security-advisories@github.com
  - url: >-
      https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91
    label: security-advisories@github.com
  - url: 'https://github.com/Laravel-Backpack/CRUD/pull/5980'
    label: security-advisories@github.com
  - url: 'https://github.com/Laravel-Backpack/CRUD/pull/5981'
    label: security-advisories@github.com
  - url: 'https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11'
    label: security-advisories@github.com
  - url: 'https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-xpv2-hrfc-hw62'
tags:
  - nvd
  - cve.org
  - ghsa
  - composer
aliases:
  - GHSA-xpv2-hrfc-hw62
ecosystem: composer
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T18:12:11.822672Z'
ingestedAt: '2026-08-20T18:59:54.951Z'
epss: 0.00551
epssPercentile: 0.43732
---

## Overview

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54175)

Affected packages:

- `backpack/crud < 6.8.11`
- `backpack/crud >= 7.0.0-alpha.1, < 7.0.34`

Patched in:

- `backpack/crud 6.8.11`
- `backpack/crud 7.0.34`

Source: https://github.com/advisories/GHSA-xpv2-hrfc-hw62