GHSA-xpv2-hrfc-hw62: Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment

Laravel Backpack's MyAccountController has a security flaw where the account info endpoint uses mass assignment (a technique that automatically saves any form field matching the model's allowed columns) to update user data, including passwords, without requiring verification of the old password. This means an attacker with a stolen session can permanently change the victim's password and take over the account, bypassing the security check that the separate password-change endpoint enforces.