The vulnerability exists in the MyAccountController::postAccountInfoForm method of Laravel-Backpack CRUD, where request data from $request->except(['_token']) is mass-assigned directly to the user model instead of being restricted to validated fields. An authenticated attacker can exploit this to change the password, authentication email, or other fillable security attributes. With Laravel 11's default user model behavior, a plaintext password submitted is hashed and saved, bypassing the old_password verification normally required for password changes. This can lead to persistent account takeover and enable further attacks such as password-reset hijacking or privilege escalation. The vulnerability is addressed in versions 6.8.11 and 7.0.34.

An attacker with an authenticated Backpack session can perform unauthorized password changes and modify authentication-related fields, resulting in persistent account takeover. Changing the authentication email can facilitate password-reset attacks, and modifying other fillable security attributes may allow privilege escalation or changes to security controls. The vulnerability impacts confidentiality, integrity, and availability to a high degree.

Upgrade Laravel-Backpack CRUD to version 6.8.11 or later, or 7.0.34 or later, where this issue is fixed. No other mitigations are specified. Patch status is confirmed by the vendor advisory.