Executive brief
Laravel Backpack CRUD is a popular Laravel admin panel toolkit. The edit account info endpoint allows authenticated users to change their password without verifying the original password, bypassing the security controls in the dedicated change-password feature. An attacker with access to a stolen or hijacked admin session (via XSS, malware, or shared workstation) can permanently take over the victim's account by changing the password, extending temporary session access into indefinite account control.
Technical details
The vulnerability is a mass-assignment flaw (CWE-620: Unverified Password Change) in MyAccountController::postAccountInfoForm at src/app/Http/Controllers/MyAccountController.php:38. The action uses $request->except(['_token']) instead of validated() or an explicit allowlist, permitting any column in the User model's $fillable array (including password, email, role_id, etc.) to be written directly from the request without validation. While a separate POST /admin/change-password endpoint enforces old_password verification, the edit-account-info handler silently bypasses this control. An authenticated attacker can issue a POST to /admin/edit-account-info with password=<new_value> and, due to Laravel's automatic password hashing, gain permanent control. The vulnerability also permits unverified email changes and mass-assignment of other sensitive fields like role_id or two_factor_secret. Patches are available: backpack/crud 6.8.11 and 7.0.34.
Affected products
- Laravel Backpack CRUD < 6.8.11, >= 7.0.0-alpha.1 < 7.0.34
Timeline
- 2026-06-15: disclosed: Advisory published by GitHub
- 2026-06-15: patched: Patches released: 6.8.11 and 7.0.34