Is CVE-2026-54175 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54175 being exploited in the wild.

How severe is CVE-2026-54175?

High severity, with a CVSS score of 7.6, published 14 September 2026.

Which products and versions are affected?

backpack/crud (Packagist) ECOSYSTEM:introduced=0,fixed=6.8.11.

Is there a fix for CVE-2026-54175?

Yes. backpack/crud (Packagist): upgrade to 6.8.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54175 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54175?

Check whether you run backpack/crud (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54175: Laravel Backpack CRUD unverified password change in MyAccountController

CVE-2026-54175 · Severity: high · CVSS 7.6 · Published 2026-09-14

Laravel Backpack CRUD is a popular Laravel admin panel toolkit. The edit account info endpoint allows authenticated users to change their password without verifying the original password, bypassing the security controls in the dedicated change-password feature. An attacker with access to a stolen or hijacked admin session (via XSS, malware, or shared workstation) can permanently take over the victim's account by changing the password, extending temporary session access into indefinite account control.

Technologies: backpack/crud (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-54175 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54175 being exploited in the wild.
How severe is CVE-2026-54175?: High severity, with a CVSS score of 7.6, published 14 September 2026.
Which products and versions are affected?: backpack/crud (Packagist) ECOSYSTEM:introduced=0,fixed=6.8.11.
Is there a fix for CVE-2026-54175?: Yes. backpack/crud (Packagist): upgrade to 6.8.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54175 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54175?: Check whether you run backpack/crud (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

backpack/crud (Packagist): upgrade to 6.8.11 or later
```
composer require backpack/crud:^6.8.11
```

Technical details

The vulnerability is a mass-assignment flaw (CWE-620: Unverified Password Change) in MyAccountController::postAccountInfoForm at src/app/Http/Controllers/MyAccountController.php:38. The action uses $request->except(['_token']) instead of validated() or an explicit allowlist, permitting any column in the User model's $fillable array (including password, email, role_id, etc.) to be written directly from the request without validation. While a separate POST /admin/change-password endpoint enforces old_password verification, the edit-account-info handler silently bypasses this control. An authenticated attacker can issue a POST to /admin/edit-account-info with password=<new_value> and, due to Laravel's automatic password hashing, gain permanent control. The vulnerability also permits unverified email changes and mass-assignment of other sensitive fields like role_id or two_factor_secret. Patches are available: backpack/crud 6.8.11 and 7.0.34.

Affected products

Laravel Backpack CRUD < 6.8.11, >= 7.0.0-alpha.1 < 7.0.34

Identifiers

CVE-2026-54175
GHSA-xpv2-hrfc-hw62

Timeline

2026-06-15: disclosed: Advisory published by GitHub
2026-06-15: patched: Patches released: 6.8.11 and 7.0.34

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.