CVE-2026-54176

backpack/crud: MyAccountController allows changing the login email without a current-password check

Published Sep 14, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account's existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow after the original session expires, converting session compromise into persistent account takeover. The same mechanism permits an insider to set a personal recovery address before access is revoked. The separate password-change endpoint is not affected because it verifies old_password. This issue is fixed in versions 6.8.14 and 7.0.38.

Analysis

Technical impact

The vulnerability allows a user with a temporary authenticated session to change the account’s recovery email address without providing the current password. By setting a new email, the attacker can then trigger the password‑reset flow after the session expires, effectively converting a short‑term session compromise into persistent account takeover.

Affected Systems

The flaw exists in Laravel‑Backpack:CRUD versions 6.0.0 through 6.8.13 and 7.0.0 through 7.0.37. It has been remediated in releases 6.8.14 and 7.0.38, where the account‑info update route now requires password confirmation before altering the email field.

Risk and Exploitability

With a CVSS score of 6.5, the vulnerability is of moderate severity. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability. It is not listed in CISA's KEV catalog. The attack vector requires that the adversary first obtain an authenticated session, but because the email can be changed without a password check, the attacker can subsequently reset the password after the session expires. This path offers persistent access, so while exploitation may depend on initial session acquisition, the potential impact is significant.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Laravel-Backpack

CRUD

affected

Version	Status	Constraints
`>= 6.0.0, < 6.8.14`	affected	—
`>= 7.0.0, < 7.0.38`	affected	—

No data.

Vendor Product Versions

Laravel-backpack

Crud

Version	Status	Scheme	Platform
`[6.0.0,6.8.14)`	affected	semver	—
`[7.0.0,7.0.38)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Backpack‑CRUD to version 6.8.14 or 7.0.38 or later, which enforces a current password check when updating the login email.
If upgrading is not immediately feasible, disable or protect the /admin/edit-account-info endpoint in environments where sensitive accounts reside.
Validate in custom code or middleware that the current password is required before allowing any change to the login email, and monitor for unauthorized email change attempts in authentication logs.

Generated by OpenCVE AI on September 20, 2026 at 22:52 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-9fw9-8c49-qch8	Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.650% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969
https://github.com/Laravel-Backpack/CRUD/commit/8ab94543d880b03c1189acb96b78186323c62a0b
https://github.com/Laravel-Backpack/CRUD/pull/5990
https://github.com/Laravel-Backpack/CRUD/pull/5994
https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14
https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38
https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-9fw9-8c49-qch8

History

Sep 15, 2026 5:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Laravel-backpack Laravel-backpack crud
Vendors & Products		Laravel-backpack Laravel-backpack crud

Sep 14, 2026 9:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account's existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow after the original session expires, converting session compromise into persistent account takeover. The same mechanism permits an insider to set a personal recovery address before access is revoked. The separate password-change endpoint is not affected because it verifies old_password. This issue is fixed in versions 6.8.14 and 7.0.38.
Title		backpack/crud: MyAccountController allows changing the login email without a current-password check
Weaknesses		CWE-287 CWE-620
References		https://github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969 https://github.com/Laravel-Backpack/CRUD/commit/8ab94543d880b03c1189acb96b78186323c62a0b https://github.com/Laravel-Backpack/CRUD/pull/5990 https://github.com/Laravel-Backpack/CRUD/pull/5994 https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14 https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38 https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-9fw9-8c49-qch8
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`