{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/laravel-backpack/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CRUD (\u003c 6.8.11, \u003e= 7.0.0-alpha.1, \u003c 7.0.34)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","web-application","php","laravel"],"_cs_type":"advisory","_cs_vendors":["Laravel Backpack"],"content_html":"\u003cp\u003eLaravel Backpack CRUD, a popular administration panel package for Laravel, contains a critical mass-assignment vulnerability (CVE-2026-54175) in the \u003ccode\u003eMyAccountController::postAccountInfoForm\u003c/code\u003e method. The controller updates the current user's profile by passing \u003ccode\u003e$request-\u0026gt;except(['_token'])\u003c/code\u003e directly to the \u003ccode\u003eupdate()\u003c/code\u003e method of the Eloquent user model. Because this approach lacks an allowlist, any database column present in the user model's \u003ccode\u003e$fillable\u003c/code\u003e array can be overwritten by the request body.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is particularly dangerous for applications using default Laravel user models where \u003ccode\u003epassword\u003c/code\u003e is marked as fillable. An attacker who has hijacked an active administrator session (e.g., via session token theft or residual access on a shared workstation) can POST arbitrary password data to the \u003ccode\u003e/admin/edit-account-info\u003c/code\u003e endpoint. Unlike the dedicated password change route, this endpoint does not enforce the verification of the current password. Successful exploitation transforms a transient session into persistent account takeover. The flaw also facilitates privilege escalation if other security-sensitive fields (e.g., \u003ccode\u003erole_id\u003c/code\u003e, \u003ccode\u003eis_admin\u003c/code\u003e) are defined as fillable.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthorized account modification, enabling persistent account takeover without knowledge of the victim's credentials. Attackers can also redirect administrative traffic by modifying the \u003ccode\u003eemail\u003c/code\u003e field to trigger future password resets or elevate their own privileges by modifying authorization-related columns if they are present in the model's fillable definition. The scope of impact is limited to authenticated users; however, it effectively bypasses multi-factor and password-verification controls intended for security-sensitive account changes.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch immediately by upgrading \u003ccode\u003ebackpack/crud\u003c/code\u003e to versions \u003ccode\u003e\u0026gt;= 6.8.11\u003c/code\u003e or \u003ccode\u003e\u0026gt;= 7.0.34\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eFor applications where immediate patching is not possible, override the \u003ccode\u003eMyAccountController\u003c/code\u003e or implement a middleware to sanitize the incoming request to \u003ccode\u003epostAccountInfoForm\u003c/code\u003e using an explicit \u003ccode\u003e$request-\u0026gt;only()\u003c/code\u003e allowlist for fields such as \u003ccode\u003ename\u003c/code\u003e and the email attribute.\u003c/li\u003e\n\u003cli\u003eReview the \u003ccode\u003eApp\\Models\\User\u003c/code\u003e model to ensure that security-sensitive attributes like \u003ccode\u003erole_id\u003c/code\u003e, \u003ccode\u003eis_admin\u003c/code\u003e, or \u003ccode\u003etwo_factor_secret\u003c/code\u003e are not included in the \u003ccode\u003e$fillable\u003c/code\u003e array.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-20T19:13:56Z","date_published":"2026-08-20T19:13:56Z","id":"https://feed.craftedsignal.io/briefs/2026-08-laravel-backpack-mass-assignment/","summary":"An authenticated mass-assignment vulnerability in Laravel Backpack CRUD allows an attacker with a session to update arbitrary user model attributes, leading to password reset, email hijacking, or privilege escalation.","title":"Laravel Backpack CRUD Mass Assignment Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-08-laravel-backpack-mass-assignment/"}],"language":"en","title":"CraftedSignal Threat Feed - Laravel Backpack","version":"https://jsonfeed.org/version/1.1"}