CVE-2026-54176: Backpack CRUD Auth Bypass Vulnerability

CVE-2026-54176 Overview

CVE-2026-54176 is an authentication weakness in backpack/crud, a Laravel package that provides Create, Read, Update, and Delete (CRUD) functionality for Backpack administration panels. The MyAccountController::postAccountInfoForm endpoint at POST /admin/edit-account-info accepts changes to the backpack_authentication_column() field (typically email) without requiring current_password verification. An attacker with a short-lived authenticated Backpack session can change the recovery email, then trigger the password-reset flow to gain persistent account takeover. The flaw is tracked under [CWE-287: Improper Authentication] and affects versions from 6.0.0 up to 6.8.14 and 7.0.38.

Critical Impact
Temporary session compromise or insider access converts into permanent account takeover through recovery-email hijacking.

Affected Products

backpack/crud versions 6.0.0 through 6.8.13
backpack/crud versions 7.0.0 through 7.0.37
Laravel Backpack administration panels using the default authentication column

Discovery Timeline

2026-09-14 - CVE-2026-54176 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-54176

Vulnerability Analysis

The vulnerability resides in how AccountInfoRequest validates updates submitted to MyAccountController::postAccountInfoForm. The controller allows an authenticated user to modify profile fields, including the authentication column used for password recovery. Unlike the separate password-change endpoint, which enforces old_password verification, the account-info endpoint performs no password re-check before mutating the email address.

This creates a re-authentication gap. An attacker who briefly hijacks a session, for example through a stolen session cookie or an unattended browser, can change the recovery email to an address they control. When the original session expires, the attacker triggers the standard password-reset flow and receives the reset token at the attacker-controlled address.

Root Cause

The AccountInfoRequest form request class did not depend on the Illuminate\Support\Facades\Hash facade and defined no validation rule requiring current_password. The design assumed session authentication alone was sufficient for identity-changing operations, violating the defense-in-depth pattern applied to the sibling password-change endpoint.

Attack Vector

Exploitation requires a valid authenticated Backpack session, giving this vulnerability a high privileges-required rating. The attack proceeds over the network with low complexity and no user interaction. It also enables insider abuse: a departing employee can set a personal recovery address before their account is disabled.

php

// Security patch in src/app/Http/Requests/AccountInfoRequest.php (PR #5990)
 namespace Backpack\CRUD\app\Http\Requests;
 
 use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Support\Facades\Hash;
 use Illuminate\Validation\Rule;
 
 class AccountInfoRequest extends FormRequest

Source: GitHub Commit 8ab9454. The patch introduces the Hash facade so the request can validate the submitted current_password against the stored credential before accepting authentication-column changes.

Detection Methods for CVE-2026-54176

Indicators of Compromise

Unexpected POST requests to /admin/edit-account-info that change the email field without a preceding password-change action
Password-reset emails delivered to domains not previously associated with an admin account
Successful authentications from new IP addresses immediately after a recovery-email change

Detection Strategies

Review web server and application logs for POST /admin/edit-account-info requests where the email or authentication column value differs from the prior stored value
Alert on any recovery-email change that is not followed by a legitimate user confirmation workflow
Correlate account-info modifications with subsequent password-reset requests originating from the same session or a related IP range

Monitoring Recommendations

Enable audit logging on the MyAccountController account-info endpoint and forward events to a centralized log platform
Track sequences of session creation, email update, session expiry, and password reset within short time windows
Monitor administrator user model changes for out-of-band writes to the authentication column

How to Mitigate CVE-2026-54176

Immediate Actions Required

Upgrade backpack/crud to version 6.8.14 or 7.0.38 using Composer
Audit all administrator accounts for unauthorized changes to the recovery email address
Invalidate active Backpack admin sessions and require re-authentication after patching
Rotate credentials for any account whose recovery address was changed by a party other than the account owner

Patch Information

The maintainers released fixes in Backpack CRUD 6.8.14 and Backpack CRUD 7.0.38. The fix requires current_password when updating the authentication column, as implemented in Pull Request #5990 and Pull Request #5994. Additional context is available in GitHub Security Advisory GHSA-9fw9-8c49-qch8.

Workarounds

Override MyAccountController::postAccountInfoForm in application code to require and verify current_password before saving
Restrict access to /admin/edit-account-info behind an additional middleware requiring recent re-authentication
Temporarily disable the account-info edit route until the upgrade is applied

bash

# Upgrade Backpack CRUD via Composer
composer require backpack/crud:^6.8.14
# or for the 7.x branch
composer require backpack/crud:^7.0.38
composer update backpack/crud