{"action":"Upgrade backpack/crud to 6.8.11 or later.","affected":[{"fixed":"6.8.11","introduced":"0"},{"fixed":"7.0.34","introduced":"7.0.0-alpha.1"}],"component":"backpack/crud","cve_ids":["CVE-2026-54175"],"ecosystem":"Packagist","epss":0.00551,"exploited":false,"fixed_versions":["6.8.11","7.0.34"],"ghsa_id":"GHSA-xpv2-hrfc-hw62","id":"tcs_01M5KFB85XBEXPYMKKXEQPZENC","modified_at":"2026-08-20T18:48:09.407987Z","published_at":"2026-08-20T18:38:26Z","references":["https://osv.dev/vulnerability/GHSA-xpv2-hrfc-hw62","https://github.com/Laravel-Backpack/CRUD/security/advisories/GHSA-xpv2-hrfc-hw62","https://github.com/Laravel-Backpack/CRUD/pull/5980","https://github.com/Laravel-Backpack/CRUD/pull/5981","https://github.com/Laravel-Backpack/CRUD","https://github.com/Laravel-Backpack/CRUD/releases/tag/6.8.11","https://github.com/Laravel-Backpack/CRUD/releases/tag/7.0.34"],"severity":{"label":"high","score":7.6},"sources":[{"source":"osv","source_id":"GHSA-xpv2-hrfc-hw62","url":"https://osv.dev/vulnerability/GHSA-xpv2-hrfc-hw62"}],"summary":"Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment"}