EUVD-2026-77718
GHSA-9fw9-8c49-qch8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Network-accessible endpoint (AV:N, AC:L) requires a valid authenticated session (PR:H); successful exploitation yields full credential takeover (C:H/I:H) with no availability impact.
Primary rating from Vendor (https://github.com/Laravel-Backpack/CRUD).
CVSS VectorVendor: https://github.com/Laravel-Backpack/CRUD
Lifecycle Timeline
3DescriptionCVE.org
Summary
MyAccountController::postAccountInfoForm allows an authenticated user to update the authentication column (default: email) without verifying their current password. Because email is the account-recovery anchor, this enables account takeover after the attacker's session ends: the new email address can be used to request a password reset from outside the system.
The password-change endpoint in the same controller correctly requires old_password verification, so the gap is asymmetric.
Details
The postAccountInfoForm action passes $request->validated() directly to $user->update(). The AccountInfoRequest whitelists the authentication column (email by default) with no ownership challenge. Contrast this with ChangePasswordRequest, which uses Hash::check against the stored password before allowing any change.
Scenarios where this is exploitable include:
- A brief unauthorized session (e.g. unattended workstation, XSS in the admin panel)
- An insider/offboarding case where a departing admin sets a personal email address
before access is revoked, then resets the password after leaving
Patch
Fixed in #5990 - the authentication column is now protected by a current_password check (mirroring ChangePasswordRequest) whenever its value changes.
A stronger mitigation - sending a verification link to the new address before persisting the change - can be layered on top using Laravel's MustVerifyEmail flow.
Affected versions
All versions prior to 6.8.14 / 7.0.38.
Fixed versions
- 6.x: 6.8.14
- 7.x: 7.0.38
AnalysisAI
Laravel Backpack CRUD versions prior to 6.8.14 (6.x branch) and 7.0.38 (7.x branch) allow any authenticated user to change the account's login email address without supplying their current password, enabling persistent account takeover that survives session termination. The asymmetry is stark: the password-change endpoint in the same controller enforces a Hash::check against the stored password, but the account-info update path passes the request directly to mass-assignment without an ownership challenge. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with access to the MyAccountController account-info update endpoint - corresponding to PR:H in the CVSS vector, meaning the attacker must have (or briefly obtain) admin-level credentials or a valid session token. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, score 6.5) correctly captures the key limiting factor: PR:H requires an existing authenticated session, which substantially narrows the attack surface compared to unauthenticated network vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to backpack/crud 6.8.14 (6.x branch) or 7.0.38 (7.x branch), both confirmed fixed by the vendor advisory and release tags at https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.14 and https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.38. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allShare
External POC / Exploit Code
Leaving vuln.today