Missing Authorization Vulnerability in Laradashboard Affects Local License API

CVE-2026-90933

What is CVE-2026-90933?

The Local License API in laradashboard versions up to 1.2.2 has a missing authorization vulnerability that enables authenticated users with low privileges to exploit several endpoints. This flaw permits them to access sensitive operations such as retrieving, overwriting, and deleting premium module license keys. Specifically, the endpoints GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove are vulnerable. Attackers can potentially disclose confidential license information, alter it with attacker-controlled data, or entirely remove existing licenses, leading to severe implications for license management and software integrity.

References