Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Summary

The MyAccountController::postAccountInfoForm action bound to POST /admin/edit-account-info calls $this->guard()->user()->update($request->except(['_token'])). Because the controller uses except(['_token']) rather than $request->validated() or the restricted keys defined in AccountInfoRequest::validationData(), **any column present in the user model's $fillable array is mass-assigned from the request**, including password. Backpack ships a separate POST /admin/change-password route (postChangePasswordForm) that requires old_password verification via ChangePasswordRequest::withValidator. The edit-account-info endpoint silently bypasses that security control.

For the default Laravel 11 App\Models\User model — which Backpack's installer and documentation use as the canonical admin user model — $fillable is ['name','email','password']. The password cast is hashed, so a plaintext password=… form field is automatically hashed and persisted. Any attacker holding an authenticated Backpack session (session theft, stolen cookies, XSS, public-terminal residual session) can permanently take over the account by issuing one POST that includes password=<attacker_value>, with no knowledge of the victim's current password. This converts time-limited, session-bound access into persistent account takeover.

Vulnerable code

src/app/Http/Controllers/MyAccountController.php:38

public function postAccountInfoForm(AccountInfoRequest $request)
{
    $result = $this->guard()->user()->update($request->except(['_token']));
    ...
}

src/app/Http/Requests/AccountInfoRequest.php validationData() only narrows what gets validated (name, email column) — it does NOT narrow what is later saved.

Impact

1. Persistent account takeover after session theft. An adversary holding any authenticated Backpack session cookie (XSS, malware, stolen device, shared workstation) can rewrite the victim's password and retain access indefinitely, even after the original session expires or the victim logs out. Without this bypass the equivalent action requires old_password, which the adversary does not have.
2. Email pivot for full takeover. The same handler permits unverified change of the authentication column (email by default). A hijacked session can change the email to one the attacker controls and then use Backpack's password-reset flow as a backup channel.
3. **Mass-assignment of any other $fillable attribute.** In real deployments where the admin user model carries fields such as role_id, is_admin, team_id, email_verified_at, two_factor_secret, etc., the same request mass-assigns those fields. This expands the impact to privilege escalation and 2FA disablement on apps that follow standard Laravel patterns of adding such columns to $fillable.

Fix recommendation

Replace $request->except(['_token']) with an explicit allowlist that mirrors AccountInfoRequest::validationData():

public function postAccountInfoForm(AccountInfoRequest $request)
{
    $data = $request->only([backpack_authentication_column(), 'name']);
    $result = $this->guard()->user()->update($data);
    ...
}

This preserves change-password as the sole path for password mutation (which already enforces old_password).

Coordinates

• Repository: https://github.com/Laravel-Backpack/CRUD
• Vulnerable file & line: src/app/Http/Controllers/MyAccountController.php:38 (release 6.8.10; master e7201c5)
• Route: POST /admin/edit-account-info (default admin prefix; setup_my_account_routes=true)
• Verified against: backpack/crud 6.8.10, laravel/framework 11.x, PHP 8.4.7

— therawdev (responsible disclosure)

Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304)