Description

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account's existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow after the original session expires, converting session compromise into persistent account takeover. The same mechanism permits an insider to set a personal recovery address before access is revoked. The separate password-change endpoint is not affected because it verifies old_password. This issue is fixed in versions 6.8.14 and 7.0.38.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T18:17:52.593Z",
  "pubdate": "2026-09-14T18:17:52.593Z",
  "executiveSummary": "The vulnerability identified in backpack/crud involves an improper authentication check within the MyAccountController::postAccountInfoForm method.\nThis flaw allows an authenticated user to modify the account's primary email address (backpack_authentication_column) without verifying the current password.\nThe vulnerability affects versions 6.0.0 through 6.8.14 and 7.0.38, posing a significant risk of persistent account takeover.\nAn attacker possessing a temporary or transient authenticated session can update the recovery email address to an attacker-controlled account.\nOnce the original session expires, the attacker can leverage the standard password-reset workflow to gain permanent control of the victim's account.\nThis impact extends to internal threat scenarios where an entity might set a personal recovery address to maintain access after credentials have been revoked.\nThe vulnerability requires an initial authenticated session, limiting the attack surface to existing low-privileged accounts or hijacked sessions.",
  "technicalDetails": "The root cause of the vulnerability resides in the postAccountInfoForm function within the MyAccountController, specifically at the POST /admin/edit-account-info endpoint. The application processes user-supplied data via the AccountInfoRequest without requiring re-authentication or the verification of the current_password.\nBy design, the backpack_authentication_column (defaulting to 'email') is used as the primary identifier for authentication workflows. Because the controller permits updates to this field without a password check, it bypasses the security controls enforced in the separate password-change endpoint, which correctly mandates an old_password validation.\nThe attack flow begins with an attacker successfully authenticating into the Backpack administration panel. This can be achieved through session hijacking, credential theft, or by an insider with legitimate access. Once authenticated, the attacker submits a POST request to /admin/edit-account-info, injecting an arbitrary email address into the account profile.\nBecause the application logic fails to validate the user's existing credentials before applying these updates, the email address linked to the user account is updated in the underlying database immediately. The attacker's session remains active, masking the unauthorized change from the legitimate user.\nFollowing the unauthorized update, the attacker waits for the session to expire. Upon expiration, the attacker initiates the standard 'forgot password' or 'password reset' flow provided by the application. Since the recovery email has been changed to one under the attacker's control, they receive the password-reset token, allowing them to define a new password and achieve full, persistent account takeover.\nThis vulnerability is particularly dangerous in environments where session timeouts are long or where session management lacks robust monitoring for account configuration changes. The issue is confirmed present in versions 6.0.0 up to 6.8.14 and 7.0.38. The discrepancy in security controls between the password-change module and the account-info-update module represents a failure to apply consistent 'privileged-action' security standards across the administrative interface."
}