Description

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-14T18:17:52.430Z",
  "pubdate": "2026-09-14T18:17:52.430Z",
  "executiveSummary": "A critical mass assignment vulnerability exists in backpack/crud within the MyAccountController::postAccountInfoForm method.\nThe vulnerability allows an authenticated attacker to perform unauthorized updates to sensitive user model attributes, such as passwords, authentication credentials, and deployment-specific security fields.\nThis flaw facilitates persistent account takeover and potential privilege escalation by bypassing intended validation logic.\nThe vulnerability affects versions prior to 6.8.11 and 7.0.34 of backpack/crud.\nExploitation requires an active authenticated session within the administrative panel.\nBy manipulating the POST /admin/edit-account-info request, an attacker can override protected attributes, effectively gaining complete control over victim accounts or modifying system-level security parameters without satisfying mandatory change-password requirements.",
  "technicalDetails": "The root cause of the vulnerability is the insecure handling of request data in src/app/Http/Controllers/MyAccountController.php. Specifically, the postAccountInfoForm function improperly passes the entirety of the request input (excluding the _token field) directly to the user model update process.\nThe application fails to utilize the validated data provided by AccountInfoRequest::validationData(), which is intended to constrain the fields that can be updated. By using $request->except(['_token']), the controller creates an insecure bridge between raw user input and the underlying Eloquent model.\nThe attack flow begins when an authenticated user sends a crafted POST request to /admin/edit-account-info. Because the model consumes the entire request array, an attacker can include additional keys in the payload that correspond to internal model attributes. In a default Laravel 11 environment, if the user model marks fields like 'password' or 'email' as fillable, the application will blindly accept these inputs.\nThe impact of this behavior is significant: submitted plaintext passwords are automatically intercepted and processed by Laravel's internal hashing mechanisms. This allows an attacker to reset the password of any account they have reached via an authenticated session, completely bypassing the security check (old_password validation) normally required in dedicated password-change routes.\nFurthermore, because the mass assignment is not restricted to standard user profile fields, attackers can target any 'fillable' attribute. This includes authentication-related columns that, if modified, enable account takeover via email-based password reset flows, or deployment-specific configuration columns that may grant elevated administrative privileges or degrade system security controls.\nThe vulnerability exists in all backpack/crud versions before 6.8.11 and 7.0.34. The attack is strictly limited to users who have already obtained a valid administrative session, but it provides a critical vector for lateral movement and persistence, escalating a standard authenticated session to full administrative compromise."
}