« Volver al listado

CVE-2026-54175

Estado: AplazadaAlta (7.6)—

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData().

Leer descripción completaMostrar menos

An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Mass-assignment en controlador Laravel con PR:L permite modificar atributos de usuario (contraseña, email de autenticación); acceso remoto autenticado a servicio que requiere privilegios previos. Impacto: modificación de credenciales de cuenta (T1098.002), control persistente de sesión (T1078.001) y

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementMulti-factor AuthenticationDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Laravel — LaravelAIYangyouwang — CrudAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-54175",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54175",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-14T18:12:11.822672Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Laravel-Backpack",
          "product": "CRUD",
          "versions": [
            {
              "status": "affected",
              "version": "< 6.8.11"
            },
            {
              "status": "affected",
              "version": ">= 7.0.0, < 7.0.34"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-09-14T18:17:52.430",
  "references": [
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/0d7a2820a0a356fde94c13a2db78bbe44393f0e7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/commit/ffe9a43ed006d0667e52997036c05ac0bc06cf91",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5980",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/pull/5981",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-620"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can therefore mass-assign password, the authentication column, or other deployment-specific fillable attributes. With the default Laravel 11 user model, a submitted plaintext password is automatically hashed and persisted, converting temporary session access into persistent account takeover without the old_password check enforced by the separate password-change route. Changing the authentication email can also enable later password-reset takeover, while additional fillable security attributes can permit deployment-specific privilege escalation or security-control changes. This issue is fixed in versions 6.8.11 and 7.0.34."
    }
  ],
  "lastModified": "2026-09-30T19:57:08.043",
  "sourceIdentifier": "security-advisories@github.com"
}