Laravel Backpack CRUD Mass Assignment Vulnerability

Laravel Backpack CRUD, a popular administration panel package for Laravel, contains a critical mass-assignment vulnerability (CVE-2026-54175) in the MyAccountController::postAccountInfoForm method. The controller updates the current user's profile by passing $request->except(['_token']) directly to the update() method of the Eloquent user model. Because this approach lacks an allowlist, any database column present in the user model's $fillable array can be overwritten by the request body.

This vulnerability is particularly dangerous for applications using default Laravel user models where password is marked as fillable. An attacker who has hijacked an active administrator session (e.g., via session token theft or residual access on a shared workstation) can POST arbitrary password data to the /admin/edit-account-info endpoint. Unlike the dedicated password change route, this endpoint does not enforce the verification of the current password. Successful exploitation transforms a transient session into persistent account takeover. The flaw also facilitates privilege escalation if other security-sensitive fields (e.g., role_id, is_admin) are defined as fillable.

Impact

Successful exploitation results in unauthorized account modification, enabling persistent account takeover without knowledge of the victim's credentials. Attackers can also redirect administrative traffic by modifying the email field to trigger future password resets or elevate their own privileges by modifying authorization-related columns if they are present in the model's fillable definition. The scope of impact is limited to authenticated users; however, it effectively bypasses multi-factor and password-verification controls intended for security-sensitive account changes.

Recommendation

1. Patch immediately by upgrading backpack/crud to versions >= 6.8.11 or >= 7.0.34.
2. For applications where immediate patching is not possible, override the MyAccountController or implement a middleware to sanitize the incoming request to postAccountInfoForm using an explicit $request->only() allowlist for fields such as name and the email attribute.
3. Review the App\Models\User model to ensure that security-sensitive attributes like role_id, is_admin, or two_factor_secret are not included in the $fillable array.