---
id: CVE-2026-54176
title: >-
  backpack/crud provides Create, Read, Update & Delete (CRUD) functions for
  Backpack, a collection of Laravel packages that help users build custom
  administration panels
summary: >-
  backpack/crud provides Create, Read, Update & Delete (CRUD) functions for
  Backpack, a collection of Laravel packages that help users build custom
  administration panels. From 6.0.0 until 6.8.14 and 7.0.38,
  MyAccountController::postAccount…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-287
  - CWE-620
vendor: Laravel-Backpack
product: CRUD
affected:
  - 'CRUD >= 6.0.0, < 6.8.14'
  - 'CRUD >= 7.0.0, < 7.0.38'
patched:
  - backpack/crud 6.8.14
  - backpack/crud 7.0.38
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T19:17:29.667'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54176'
references:
  - url: >-
      https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969
    label: security-advisories@github.com
  - url: >-
      https://github.com/Laravel-Backpack/CRUD/commit/8ab94543d880b03c1189acb96b78186323c62a0b
    label: security-advisories@github.com
  - url: 'https://github.com/Laravel-Backpack/CRUD/pull/5990'
    label: security-advisories@github.com
  - url: 'https://github.com/Laravel-Backpack/CRUD/pull/5994'
    label: security-advisories@github.com
  - url: 'https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14'
    label: security-advisories@github.com
  - url: 'https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-9fw9-8c49-qch8
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-9fw9-8c49-qch8'
tags:
  - nvd
  - cve.org
  - ghsa
  - composer
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-14T19:11:17.105374Z'
aliases:
  - GHSA-9fw9-8c49-qch8
ecosystem: composer
ingestedAt: '2026-08-20T18:59:54.916Z'
epss: 0.0065
epssPercentile: 0.48907
---

## Overview

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account's existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow after the original session expires, converting session compromise into persistent account takeover. The same mechanism permits an insider to set a personal recovery address before access is revoked. The separate password-change endpoint is not affected because it verifies old_password. This issue is fixed in versions 6.8.14 and 7.0.38.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54176)

Affected packages:

- `backpack/crud >= 6.0.0, < 6.8.14`
- `backpack/crud >= 7.0.0, < 7.0.38`

Patched in:

- `backpack/crud 6.8.14`
- `backpack/crud 7.0.38`

Source: https://github.com/advisories/GHSA-9fw9-8c49-qch8