CVE-2026-54176 backpack/crud: MyAccountController allows changing the login email without a current-password check
Authenticated attackers can change the recovery email without password verification, enabling persistent account takeover via password reset.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54176?
CVE-2026-54176 is a medium-severity vulnerability in Laravel-Backpack CRUD, published on 14 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account's existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow after the original session expires, converting session compromise into persistent account takeover. The same mechanism permits an insider to set a personal recovery address before access is revoked. The separate password-change endpoint is not affected because it verifies old_password. This issue is fixed in versions 6.8.14 and 7.0.38.
Which versions are affected by CVE-2026-54176?
4 open source packages ship an affected version, including backpack/crud.
| Package | Affected | Fixed in |
|---|---|---|
backpack/crud Packagist | From 6.0.0 | 6.8.14 |
backpack/crud Packagist | From 6.0.0 | 6.8.14 |
backpack/crud Packagist | From 7.0.0 | 7.0.38 |
backpack/crud Packagist | From 7.0.0 | 7.0.38 |
How do I fix CVE-2026-54176?
Upgrade backpack/crud to a fixed version for your release line: 6.8.14 or 7.0.38.
Is CVE-2026-54176 being exploited?
There is no known exploitation of CVE-2026-54176 in the wild and no public exploit code.
Sources
Also known as GHSA-9fw9-8c49-qch8.