CVE-2026-90933 Details
Description
laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys, inject attacker-controlled values, or delete stored licenses entirely.
A missing authorization vulnerability has been identified in laradashboard versions through 1.2.2, specifically within the Local License API endpoints. This vulnerability allows any authenticated user, regardless of their role or permissions, to read, overwrite, and delete premium module license keys. Low-privileged accounts can access the endpoints GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove. The issue arises because the Form Requests associated with these endpoints hardcode authorization to true, bypassing any necessary permission checks. As a result, a user with default 'Subscriber' permissions can exploit this vulnerability to disclose confidential license keys, inject unauthorized values, or completely remove stored licenses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j4m5-rrc4-5qv6 | CISA-ADP | AdvisoryExploitVendor |
| https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j4m5-rrc4-5qv6 | [email protected] | AdvisoryExploitVendor |
| https://www.vulncheck.com/advisories/laradashboard-through-1.2.2-missing-authorization-via-license-api | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| laradashboard | <= 1.2.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |