Executive brief
Laravel Backpack CRUD is a popular library for building admin panels in Laravel applications. The MyAccountController in affected versions allows authenticated users to change their login email address without verifying their current password. Since email is typically used for password recovery, an attacker who gains brief access to a user's session (via an unattended workstation, session theft, or XSS) can hijack the account by changing the email and then requesting a password reset from outside the system.
Technical details
The vulnerability exists in the `MyAccountController::postAccountInfoForm` method, which passes user-submitted data directly to `$user->update()` without requiring password verification for sensitive fields. The `AccountInfoRequest` validation class whitelists the authentication column (email by default) with no ownership challenge, creating an asymmetric security gap compared to the password-change endpoint which correctly uses `Hash::check()` to verify the old password. An authenticated attacker with temporary session access can invoke this endpoint to change the account's email to an address they control, then use the account recovery flow to reset the password and gain permanent control. The fix (merged in PR #5990) adds a `current_password` check when the authentication column changes, mirroring the security model of password changes.
Affected products
- Laravel Backpack CRUD 6.0.0 to 6.8.13, 7.0.0 to 7.0.37
Timeline
- 2026-06-15: disclosed: Initial advisory published
- 2026-06-15: patched: Fix merged in PR #5990; versions 6.8.14 and 7.0.38 released
- 2026-08-20: advisory: GitHub Security Advisory GHSA-9fw9-8c49-qch8 published; CVE-2026-54176 assigned