Incorrect Authorization Vulnerability in LaraDashboard by LaraDashboard Vendor

CVE-2026-120487

What is CVE-2026-120487?

LaraDashboard versions prior to 1.4.5 are vulnerable to an incorrect authorization flaw that allows non-Superadmin administrators with settings.edit privileges to perform core upgrade operations exclusive to Superadmin. This vulnerability can be exploited to access sensitive actions such as backup, download, restore, and upgrade through the /admin/settings/core-upgrades endpoint, potentially exposing database dumps that contain password hashes. Proper access controls should be enforced to mitigate unauthorized access to administrative functionalities.

References