CyberRota Analysis
AI-GeneratedThe vulnerability allows an attacker with a temporary authenticated session in Backpack to change the account-recovery email without verifying the existing password, potentially leading to persistent account takeover. This risk is particularly concerning for organizations using versions 6.0.0 to 6.8.14 and 7.0.38, as it enables both external attackers and insiders to exploit the flaw. Users of affected versions should prioritize updating to the patched releases (6.8.14 and 7.0.38) to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account's existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow after the original session expires, converting session compromise into persistent account takeover. The same mechanism permits an insider to set a personal recovery address before access is revoked. The separate password-change endpoint is not affected because it verifies old_password. This issue is fixed in versions 6.8.14 and 7.0.38.