GHSA-xpv2-hrfc-hw62

## Summary

The `MyAccountController::postAccountInfoForm` action bound to `POST /admin/edit-account-info` calls `$this->guard()->user()->update($request->except(['_token']))`. Because the controller uses `except(['_token'])` rather than `$request->validated()` or the restricted keys defined in `AccountInfoRequest::validationData()`, **any column present in the user model's `$fillable` array is mass-assigned from the request**, including `password`. Backpack ships a separate `POST /admin/change-password` route (`postChangePasswordForm`) that requires `old_password` verification via `ChangePasswordRequest::withValidator`. The `edit-account-info` endpoint silently bypasses that security control.

For the default Laravel 11 `App\Models\User` model — which Backpack's installer and documentation use as the canonical admin user model — `$fillable` is `['name','email','password']`. The `password` cast is `hashed`, so a plaintext `password=…` form field is automatically hashed and persisted. Any attacker holding an authenticated Backpack session (session theft, stolen cookies, XSS, public-terminal residual session) can permanently take over the account by issuing one POST that includes `password=<attacker_value>`, with no knowledge of the victim's current password. This converts time-limited, session-bound access into persistent account takeover.

## Vulnerable code

`src/app/Http/Controllers/MyAccountController.php:38`

```php public function postAccountInfoForm(AccountInfoRequest $request) { $result = $this->guard()->user()->update($request->except(['_token'])); ... } ```

`src/app/Http/Requests/AccountInfoRequest.php` `validationData()` only narrows what gets validated (`name`, email column) — it does NOT narrow what is later saved.

## Impact

1. **Persistent account takeover after session theft.** An adversary holding any authenticated Backpack session cookie (XSS, malware, stolen device, shared workstation) can rewrite the victim's password and retain access indefinitely, even after the original session expires or the victim logs out. Without this bypass the equivalent action requires `old_password`, which the adversary does not have. 2. **Email pivot for full takeover.** The same handler permits unverified change of the authentication column (`email` by default). A hijacked session can change the email to one the attacker controls and then use Backpack's password-reset flow as a backup channel. 3. **Mass-assignment of any other `$fillable` attribute.** In real deployments where the admin user model carries fields such as `role_id`, `is_admin`, `team_id`, `email_verified_at`, `two_factor_secret`, etc., the same request mass-assigns those fields. This expands the impact to privilege escalation and 2FA disablement on apps that follow standard Laravel patterns of adding such columns to `$fillable`.

## Fix recommendation

Replace `$request->except(['_token'])` with an explicit allowlist that mirrors `AccountInfoRequest::validationData()`:

```php public function postAccountInfoForm(AccountInfoRequest $request) { $data = $request->only([backpack_authentication_column(), 'name']); $result = $this->guard()->user()->update($data); ... } ```

This preserves `change-password` as the sole path for password mutation (which already enforces `old_password`).

## Coordinates

- Repository: https://github.com/Laravel-Backpack/CRUD - Vulnerable file & line: `src/app/Http/Controllers/MyAccountController.php:38` (release 6.8.10; master `e7201c5`) - Route: `POST /admin/edit-account-info` (default admin prefix; `setup_my_account_routes=true`) - Verified against: `backpack/crud 6.8.10`, `laravel/framework 11.x`, PHP 8.4.7

— therawdev (responsible disclosure)

Reported by AI Agent sechub.dev and Vishal Shukla (@shukla304)