GHSA-9fw9-8c49-qch8: XSS
Summary
MyAccountController::postAccountInfoForm allows an authenticated user to update the authentication column (default: email) without verifying their current password. Because email is the account-recovery anchor, this enables account takeover after the attacker's session ends: the new email address can be used to request a password reset from outside the system.
The password-change endpoint in the same controller correctly requires oldpassword verification, so the gap is asymmetric.
Details
The postAccountInfoForm action passes $request->validated() directly to $user->update(). The AccountInfoRequest whitelists the authentication column (email by default) with no ownership challenge. Contrast this with ChangePasswordRequest, which uses Hash::check against the stored password before allowing any change.
Scenarios where this is exploitable include: - A brief unauthorized session (e.g. unattended workstation, XSS in the admin panel) - An insider/offboarding case where a departing admin sets a personal email address before access is revoked, then resets the password after leaving
Patch
Fixed in #5990 — the authentication column is now protected by a currentpassword check (mirroring ChangePasswordRequest) whenever its value changes.
A stronger mitigation — sending a verification link to the new address before persisting the change — can be layered on top using Laravel's MustVerifyEmail flow.
Affected versions
All versions prior to 6.8.14 / 7.0.38.
Fixed versions
- 6.x: 6.8.14 - 7.x: 7.0.38
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/backpack/crudto a version that resolves this vulnerability.Fixed in 7.0.38 - Upgrade
Upgrade
composer/backpack/crudto a version that resolves this vulnerability.Fixed in 6.8.14 - Upgrade
Upgrade
Laravel-Backpack/CRUDto a version that resolves this vulnerability.Fixed in 6.8.14 - Upgrade
Upgrade
Laravel-Backpack/CRUDto a version that resolves this vulnerability.Fixed in 7.0.38
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs an authenticated session for the target account or admin user. Exploitation can follow a brief unauthorized session, such as access to an unattended workstation or XSS in the admin panel, or occur when a departing insider still has access.
How does changing the authentication email lead to account takeover?
An attacker can replace the account's authentication column, which defaults to email, without providing the current password. After their session ends, they can use the newly assigned email address to initiate password recovery and reset the password from outside the system.
Is the password-change functionality affected in the same way?
No. The password-change endpoint uses old_password verification against the stored password; the missing verification applies specifically to the account-information update path.
What release contains the fix?
The issue was fixed in Backpack CRUD release 6.8.14.