CVE-2026-54175
1 advisory.
Packagist/backpack/crud CVE-2026-54175: high 7.6, EPSS 0.55%
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
Action: Upgrade backpack/crud to 6.8.11 or later.
composer require backpack/crud:6.8.11composer require backpack/crud:7.0.34Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.8.11 | - |
| 7.0.0-alpha.1 | 7.0.34 | - |
Fixed versions
| 6.8.11 | 7.0.34 |
Sources
- osv: GHSA-xpv2-hrfc-hw62
- https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62
- https://github.com/Laravel-Backpack/CRUD/pull/5980
- https://github.com/Laravel-Backpack/CRUD/pull/5981
- https://github.com/Laravel-Backpack/CRUD
- https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11
- https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34
CVE-2026-54175 · published · modified · JSON