Auth bypass in Laravel-Backpack Crud
CVE-2026-54176
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account's existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow after the original session expires, converting session compromise into persistent account takeover. The same mechanism permits an insider to set a personal recovery address before access is revoked. The separate password-change endpoint is not affected because it verifies old_password. This issue is fixed in versions 6.8.14 and 7.0.38.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.006 (51.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 51.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Laravel-Backpack Crud — versions >= 6.0.0, < 6.8.14, >= 7.0.0, < 7.0.38
Weakness classification (CWE)
References
- github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-9fw9-8c49-qch8
- github.com/Laravel-Backpack/CRUD/pull/5990
- github.com/Laravel-Backpack/CRUD/pull/5994
- github.com/Laravel-Backpack/CRUD/commit/76c3a6e50e3fbd6d5f633208da5b04acb8322969
- github.com/Laravel-Backpack/CRUD/commit/8ab94543d880b03c1189acb96b78186323c62a0b
- github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14
- github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38
Frequently asked questions
- What is CVE-2026-54176?
- CVE-2026-54176 is a medium-severity vulnerability in Laravel-Backpack Crud, classified under Improper Authentication. CVSS score: 6.5/10. Published 2026-09-14.
- How severe is CVE-2026-54176?
- Medium severity. CVSS v3 base score is 6.5 out of 10.