high · 7.6CVE-2026-54175Aug 20, 2026

CVE-2026-54175: Laravel Backpack CRUD Unverified Password Change via Mass Assignment

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A flaw in Backpack for Laravel lets any attacker who has stolen an admin session cookie permanently take over the account by injecting a new password into the account-info form, with no knowledge of…

Packagebackpack/crud
Ecosystemcomposer
Affected< 6.8.11
Fixed in6.8.11
CVE-2026-54175: Laravel Backpack CRUD Unverified Password Change via Mass Assignment

The problem

The postAccountInfoForm action in MyAccountController (bound to POST /admin/edit-account-info) saves incoming form data with $request->except(['_token']), passing every other field directly into an Eloquent mass assignment.

Because the default Laravel App\Models\User model has password in $fillable and the hashed cast applied, sending a plain-text password field silently hashes and persists the new value. The dedicated POST /admin/change-password route enforces old_password verification through ChangePasswordRequest::withValidator, but this endpoint completely bypasses that control.

Any attacker holding an authenticated session (via XSS, session fixation, stolen cookie, or an unattended workstation) can lock the legitimate user out permanently. The same request can also overwrite the authentication column (email by default) or any other $fillable attribute such as role_id, is_admin, or two_factor_secret.

Proof of concept

A working proof-of-concept for CVE-2026-54175 in backpack/crud, with the exact payload below.

http
POST /admin/edit-account-info HTTP/1.1
Host: target.example.com
Cookie: backpack_session=<stolen_session_cookie>
Content-Type: application/x-www-form-urlencoded

_token=<valid_csrf_token>&name=Admin&email=victim%40example.com&password=AttackerNewPass1%21

The root cause is CWE-620 (Unverified Password Change): $request->except(['_token']) is a blocklist, not an allowlist. The AccountInfoRequest form request narrows what gets validated to name and the auth column only, but that narrowing never applies to what gets saved.

The patch (PR #5980 / #5981, released in 6.8.11) replaces the call with $request->only([backpack_authentication_column(), 'name']), an explicit allowlist that mirrors the validation rules. Because password is never in that list, it can no longer be mass-assigned through this endpoint, even if the underlying model has it in $fillable.

The hashed cast on the Laravel 11 User model meant no separate hashing step was needed by the attacker, just a plain-text value submitted as a form field.

The fix

Update backpack/crud to version 6.8.11 (or 7.0.34 for the v7 branch). The fix replaces the dangerous $request->except(['_token']) call with $request->only([backpack_authentication_column(), 'name']) in MyAccountController::postAccountInfoForm, so password and any other unintended $fillable columns can no longer be mass-assigned through the account-info form.

If an immediate upgrade is not possible, override postAccountInfoForm in a custom controller and apply the same only() allowlist manually.

Reported by Vishal Shukla (@shukla304) and AI Agent sechub.dev (therawdev).

References: [1][2][3][4][5][6]

Related research