Laravel Backpack

An authenticated mass-assignment vulnerability in Laravel Backpack CRUD allows an attacker with a session to update arbitrary user model attributes, leading to password reset, email hijacking, or privilege escalation.