Skip to content

Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check

Moderate severity GitHub Reviewed Published Jun 15, 2026 in Laravel-Backpack/CRUD • Updated Aug 20, 2026

Package

composer backpack/crud (Composer)

Affected versions

>= 6.0.0, < 6.8.14
>= 7.0.0, < 7.0.38

Patched versions

6.8.14
7.0.38

Description

Summary

MyAccountController::postAccountInfoForm allows an authenticated user to update
the authentication column (default: email) without verifying their current password.
Because email is the account-recovery anchor, this enables account takeover after
the attacker's session ends: the new email address can be used to request a password
reset from outside the system.

The password-change endpoint in the same controller correctly requires old_password
verification, so the gap is asymmetric.

Details

The postAccountInfoForm action passes $request->validated() directly to
$user->update(). The AccountInfoRequest whitelists the authentication column
(email by default) with no ownership challenge. Contrast this with
ChangePasswordRequest, which uses Hash::check against the stored password before
allowing any change.

Scenarios where this is exploitable include:

  • A brief unauthorized session (e.g. unattended workstation, XSS in the admin panel)
  • An insider/offboarding case where a departing admin sets a personal email address
    before access is revoked, then resets the password after leaving

Patch

Fixed in #5990 — the
authentication column is now protected by a current_password check (mirroring
ChangePasswordRequest) whenever its value changes.

A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's MustVerifyEmail flow.

Affected versions

All versions prior to 6.8.14 / 7.0.38.

Fixed versions

  • 6.x: 6.8.14
  • 7.x: 7.0.38

References

@tabacitu tabacitu published to Laravel-Backpack/CRUD Jun 15, 2026
Published to the GitHub Advisory Database Aug 20, 2026
Reviewed Aug 20, 2026
Last updated Aug 20, 2026

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS score

Weaknesses

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Learn more on MITRE.

Unverified Password Change

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication. Learn more on MITRE.

CVE ID

CVE-2026-54176

GHSA ID

GHSA-9fw9-8c49-qch8

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.