Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check
The advisory, in context
Summary
MyAccountController::postAccountInfoForm allows an authenticated user to update
the authentication column (default: email) without verifying their current password.
Because email is the account-recovery anchor, this enables account takeover after
the attacker's session ends: the new email address can be used to request a password
reset from outside the system.
The password-change endpoint in the same controller correctly requires old_password
verification, so the gap is asymmetric.
Details
The postAccountInfoForm action passes $request->validated() directly to
$user->update(). The AccountInfoRequest whitelists the authentication column
(email by default) with no ownership challenge. Contrast this with
ChangePasswordRequest, which uses Hash::check against the stored password before
allowing any change.
Scenarios where this is exploitable include:
- A brief unauthorized session (e.g. unattended workstation, XSS in the admin panel)
- An insider/offboarding case where a departing admin sets a personal email address before access is revoked, then resets the password after leaving
Patch
Fixed in #5990 — the
authentication column is now protected by a current_password check (mirroring
ChangePasswordRequest) whenever its value changes.
A stronger mitigation — sending a verification link to the new address before
persisting the change — can be layered on top using Laravel's MustVerifyEmail flow.
Affected versions
All versions prior to 6.8.14 / 7.0.38.
Fixed versions
- 6.x: 6.8.14
- 7.x: 7.0.38
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 6.0.0 before 6.8.14
Fixed in 6.8.14
120 explicitly affected versions
6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.1.0, 6.1.1, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.1.15, 6.1.16, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.3.0, 6.3.1, 6.3.2, 6.4.0, 6.4.1, 6.4.2, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.7.0, 6.7.1, 6.7.10, 6.7.11, 6.7.12, 6.7.13, 6.7.14, 6.7.15, 6.7.16, 6.7.17, 6.7.18, 6.7.19, 6.7.2, 6.7.20, 6.7.21, 6.7.22, 6.7.23, 6.7.24, 6.7.25, 6.7.26, 6.7.27, 6.7.28, 6.7.29, 6.7.3, 6.7.30, 6.7.31, 6.7.32, 6.7.33, 6.7.34, 6.7.35, 6.7.36, 6.7.37, 6.7.38, 6.7.39, 6.7.4, 6.7.40, 6.7.41, 6.7.42, 6.7.43, 6.7.44, 6.7.45, 6.7.46, 6.7.47, 6.7.48, 6.7.49, 6.7.5, 6.7.50, 6.7.51, 6.7.52, 6.7.53, 6.7.54, 6.7.55, 6.7.56, 6.7.6, 6.7.7, 6.7.8, 6.7.9, 6.8.0, 6.8.1, 6.8.10, 6.8.11, 6.8.12, 6.8.13, 6.8.2, 6.8.3, 6.8.4, 6.8.5, 6.8.6, 6.8.7, 6.8.8, 6.8.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.8.14"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.0.0",
"6.0.1",
"6.0.2",
"6.0.3",
"6.0.4",
"6.0.5",
"6.0.6",
"6.0.7",
"6.1.0",
"6.1.1",
"6.1.10",
"6.1.11",
"6.1.12",
"6.1.13",
"6.1.14",
"6.1.15",
"6.1.16",
"6.1.2",
"6.1.3",
"6.1.4",
"6.1.5",
"6.1.6",
"6.1.7",
"6.1.8",
"6.1.9",
"6.2.0",
"6.2.1",
"6.2.2",
"6.2.3",
"6.2.4",
"6.3.0",
"6.3.1",
"6.3.2",
"6.4.0",
"6.4.1",
"6.4.2",
"6.5.0",
"6.5.1",
"6.5.2",
"6.5.3",
"6.5.4",
"6.5.5",
"6.6.0",
"6.6.1",
"6.6.2",
"6.6.3",
"6.6.4",
"6.6.5",
"6.6.6",
"6.7.0",
"6.7.1",
"6.7.10",
"6.7.11",
"6.7.12",
"6.7.13",
"6.7.14",
"6.7.15",
"6.7.16",
"6.7.17",
"6.7.18",
"6.7.19",
"6.7.2",
"6.7.20",
"6.7.21",
"6.7.22",
"6.7.23",
"6.7.24",
"6.7.25",
"6.7.26",
"6.7.27",
"6.7.28",
"6.7.29",
"6.7.3",
"6.7.30",
"6.7.31",
"6.7.32",
"6.7.33",
"6.7.34",
"6.7.35",
"6.7.36",
"6.7.37",
"6.7.38",
"6.7.39",
"6.7.4",
"6.7.40",
"6.7.41",
"6.7.42",
"6.7.43",
"6.7.44",
"6.7.45",
"6.7.46",
"6.7.47",
"6.7.48",
"6.7.49",
"6.7.5",
"6.7.50",
"6.7.51",
"6.7.52",
"6.7.53",
"6.7.54",
"6.7.55",
"6.7.56",
"6.7.6",
"6.7.7",
"6.7.8",
"6.7.9",
"6.8.0",
"6.8.1",
"6.8.10",
"6.8.11",
"6.8.12",
"6.8.13",
"6.8.2",
"6.8.3",
"6.8.4",
"6.8.5",
"6.8.6",
"6.8.7",
"6.8.8",
"6.8.9"
]
}From 7.0.0 before 7.0.38
Fixed in 7.0.38
38 explicitly affected versions
7.0.0, 7.0.1, 7.0.10, 7.0.11, 7.0.12, 7.0.13, 7.0.14, 7.0.15, 7.0.16, 7.0.17, 7.0.18, 7.0.19, 7.0.2, 7.0.20, 7.0.21, 7.0.22, 7.0.23, 7.0.24, 7.0.25, 7.0.26, 7.0.27, 7.0.28, 7.0.29, 7.0.3, 7.0.30, 7.0.31, 7.0.32, 7.0.33, 7.0.34, 7.0.35, 7.0.36, 7.0.37, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.38"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"7.0.0",
"7.0.1",
"7.0.10",
"7.0.11",
"7.0.12",
"7.0.13",
"7.0.14",
"7.0.15",
"7.0.16",
"7.0.17",
"7.0.18",
"7.0.19",
"7.0.2",
"7.0.20",
"7.0.21",
"7.0.22",
"7.0.23",
"7.0.24",
"7.0.25",
"7.0.26",
"7.0.27",
"7.0.28",
"7.0.29",
"7.0.3",
"7.0.30",
"7.0.31",
"7.0.32",
"7.0.33",
"7.0.34",
"7.0.35",
"7.0.36",
"7.0.37",
"7.0.4",
"7.0.5",
"7.0.6",
"7.0.7",
"7.0.8",
"7.0.9"
]
}