Mass Assignment Vulnerability in Backpack for Laravel Affects User Model

CVE-2026-54175

What is CVE-2026-54175?

A mass assignment vulnerability exists in Backpack for Laravel affecting its MyAccountController where user input is not adequately restricted. Authenticated users can potentially modify sensitive fields, such as passwords, leading to account takeover. This flaw arises from the faulty handling of incoming request data which can allow malicious actors to update authentication details without proper validation. The issue has been rectified in versions 6.8.11 and 7.0.34, thus users are encouraged to update their installations promptly to mitigate risks associated with this security issue.

References