CVE-2026-54176: Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check

MyAccountController::postAccountInfoForm allows an authenticated user to update the authentication column (default: email) without verifying their current password. Because email is the account-recovery anchor, this enables account takeover after the attacker’s session ends: the new email address can be used to request a password reset from outside the system.

The password-change endpoint in the same controller correctly requires old_password verification, so the gap is asymmetric.