Is CVE-2026-54176 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54176 being exploited in the wild.

How severe is CVE-2026-54176?

Medium severity, with a CVSS score of 6.5, published 14 September 2026.

Which products and versions are affected?

backpack/crud (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.8.14.

Is there a fix for CVE-2026-54176?

Yes. backpack/crud (Packagist): upgrade to 6.8.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54176 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54176?

Check whether you run backpack/crud (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54176: Laravel Backpack CRUD authentication bypass in account email change

CVE-2026-54176 · Severity: medium · CVSS 6.5 · Published 2026-09-14

Laravel Backpack CRUD is a popular library for building admin panels in Laravel applications. The MyAccountController in affected versions allows authenticated users to change their login email address without verifying their current password. Since email is typically used for password recovery, an attacker who gains brief access to a user's session (via an unattended workstation, session theft, or XSS) can hijack the account by changing the email and then requesting a password reset from outside the system.

Technologies: backpack/crud (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-54176 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54176 being exploited in the wild.
How severe is CVE-2026-54176?: Medium severity, with a CVSS score of 6.5, published 14 September 2026.
Which products and versions are affected?: backpack/crud (Packagist) ECOSYSTEM:introduced=6.0.0,fixed=6.8.14.
Is there a fix for CVE-2026-54176?: Yes. backpack/crud (Packagist): upgrade to 6.8.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54176 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54176?: Check whether you run backpack/crud (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

backpack/crud (Packagist): upgrade to 6.8.14 or later
```
composer require backpack/crud:^6.8.14
```

Technical details

The vulnerability exists in the `MyAccountController::postAccountInfoForm` method, which passes user-submitted data directly to `$user->update()` without requiring password verification for sensitive fields. The `AccountInfoRequest` validation class whitelists the authentication column (email by default) with no ownership challenge, creating an asymmetric security gap compared to the password-change endpoint which correctly uses `Hash::check()` to verify the old password. An authenticated attacker with temporary session access can invoke this endpoint to change the account's email to an address they control, then use the account recovery flow to reset the password and gain permanent control. The fix (merged in PR #5990) adds a `current_password` check when the authentication column changes, mirroring the security model of password changes.

Affected products

Laravel Backpack CRUD 6.0.0 to 6.8.13, 7.0.0 to 7.0.37

Identifiers

CVE-2026-54176
GHSA-9fw9-8c49-qch8

Timeline

2026-06-15: disclosed: Initial advisory published
2026-06-15: patched: Fix merged in PR #5990; versions 6.8.14 and 7.0.38 released
2026-08-20: advisory: GitHub Security Advisory GHSA-9fw9-8c49-qch8 published; CVE-2026-54176 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.