CVE-2026-120487 Details
Description
LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.
An incorrect authorization vulnerability has been identified in LaraDashboard versions prior to 1.4.5. The issue resides in the SettingPolicy's management of core upgrades, where non-Superadmin administrators with the 'settings.edit' permission can access Superadmin-only core upgrade operations. This vulnerability allows such users to perform backup, download, restore, and upgrade actions that could lead to unauthorized access to sensitive data, including database dumps with password hashes, and disrupt the site's functionality by overwriting its data or causing a denial-of-service.
The vulnerability has been patched in LaraDashboard version 1.4.5. Users should update to this version to address the authorization issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LaraDashboard | <= 1.4.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |