Authentication Vulnerability in Backpack Laravel Package by Laravel
CVE-2026-54176
What is CVE-2026-54176?
A critical flaw in the Backpack CRUD package allows an authenticated attacker to change account recovery information without verifying the current password. This occurs via the AccountInfoRequest within the MyAccountController, specifically at the /admin/edit-account-info endpoint. The vulnerability enables attackers to utilize a compromised session to modify the account's recovery email address, facilitating a potential account takeover after the original session expires. This method can also be exploited by insiders before their access is removed, creating significant security risks. Affected versions include 6.0.0 through 6.8.14, and 7.0.38, with fixes implemented in version 6.8.14 and 7.0.38.
Affected Version(s)
CRUD >= 6.0.0, < 6.8.14 < 6.0.0, 6.8.14
CRUD >= 7.0.0, < 7.0.38 < 7.0.0, 7.0.38