CVE-2026-54175: Backpack CRUD Privilege Escalation Flaw

CVE-2026-54175 Overview

CVE-2026-54175 is a mass assignment vulnerability in backpack/crud, a Laravel package that provides Create, Read, Update, and Delete (CRUD) functions for building administration panels. The MyAccountController::postAccountInfoForm handler at POST /admin/edit-account-info passes $request->except(['_token']) directly to the authenticated user model. This bypasses the field restrictions defined in AccountInfoRequest::validationData(). An attacker with a valid Backpack session can overwrite the account password, the authentication column, or other fillable attributes without providing the old password required by the dedicated password-change route. The issue is fixed in versions 6.8.11 and 7.0.34.

Critical Impact
Any authenticated Backpack user can escalate a temporary session into persistent account takeover by mass-assigning the password field or the authentication email, enabling later password-reset hijacking.

Affected Products

backpack/crud versions prior to 6.8.11 (6.x branch)
backpack/crud versions prior to 7.0.34 (7.x branch)
Laravel administration panels built on Backpack using the default Laravel 11 user model

Discovery Timeline

2026-09-14 - CVE-2026-54175 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-54175

Vulnerability Analysis

The vulnerability is a mass assignment flaw classified under [CWE-620: Unverified Password Change]. The postAccountInfoForm method receives an AccountInfoRequest object, which defines a whitelist of allowed fields through validationData(). However, the controller ignores that whitelist and forwards every request field except _token to the Eloquent model's update() call.

Because Laravel's Eloquent will persist any attribute listed in the model's $fillable array, an attacker can inject arbitrary parameters into the form submission. The default Laravel 11 user model marks the password as a hashed cast, so a plaintext password sent in the request is automatically hashed and stored. Deployment-specific fillable attributes such as role identifiers or security flags may also be modified.

Root Cause

The root cause is the use of $request->except(['_token']) instead of $request->validated() when updating the user record. The form request class defines the correct set of permitted fields, but the controller never consumes that whitelist. This defeats the protection that Laravel form requests are designed to provide and exposes every fillable attribute on the user model.

Attack Vector

Exploitation requires an authenticated Backpack session with access to the account edit page. The attacker submits a crafted POST request to /admin/edit-account-info containing additional parameters such as password or the authentication email column. The server persists these values without verifying the old password, converting a session-limited compromise into a permanent account takeover. Changing the authentication email enables downstream account recovery hijacking through the standard password-reset workflow.

php

     */
    public function postAccountInfoForm(AccountInfoRequest $request)
    {
-        $result = $this->guard()->user()->update($request->except(['_token']));
+        $result = $this->guard()->user()->update($request->validated());

        if ($result) {
            Alert::success(trans('backpack::base.account_updated'))->flash();

Source: GitHub Commit 0d7a2820. The patch replaces the permissive except() call with validated(), restricting updates to fields explicitly declared in the form request.

Detection Methods for CVE-2026-54175

Indicators of Compromise

POST requests to /admin/edit-account-info containing unexpected parameters such as password, email, role_id, or other fillable attributes not present in the standard account form.
Unexplained changes to the password hash or authentication email on Backpack administrator accounts.
Password reset emails delivered to attacker-controlled addresses shortly after account-info edits.

Detection Strategies

Inspect web server and Laravel access logs for POST /admin/edit-account-info requests whose body contains fields outside the documented AccountInfoRequest schema.
Enable audit logging on the user model to capture changes to password, the authentication column, and any privilege-related fillable attributes.
Correlate account modification events with subsequent authentication attempts from new IP addresses or user agents.

Monitoring Recommendations

Alert on any modification to administrator credentials that does not originate from the dedicated password-change route.
Track EPSS movement for CVE-2026-54175 and prioritize remediation on internet-facing Backpack deployments.
Review Laravel telescope or query logs for update users statements touching columns not exposed by the account form.

How to Mitigate CVE-2026-54175

Immediate Actions Required

Upgrade backpack/crud to 6.8.11 on the 6.x branch or 7.0.34 on the 7.x branch using Composer.
Rotate credentials for all Backpack administrator accounts and invalidate active sessions after patching.
Review the $fillable array on the user model and remove any attributes that should not be user-editable.

Patch Information

The fix is delivered in GitHub Release 6.8.11 and GitHub Release 7.0.34. The corresponding commits are 0d7a2820 and ffe9a43e, merged in Pull Request #5980 and Pull Request #5981. Full technical details are in the GitHub Security Advisory GHSA-xpv2-hrfc-hw62.

Workarounds

Override MyAccountController::postAccountInfoForm in your application and replace $request->except(['_token']) with $request->validated().
Tighten the user model's $fillable array to exclude password, the authentication column, and any privilege attributes.
Restrict access to /admin/edit-account-info behind additional authorization middleware until the upgrade is deployed.

bash

# Upgrade Backpack CRUD to a patched release
composer require backpack/crud:^7.0.34
# or, for the 6.x branch
composer require backpack/crud:^6.8.11

# Verify the installed version
composer show backpack/crud | grep versions