CVE-2026-120487
Deferred Deferred - Pending Action

Incorrect Authorization in LaraDashboard Allows Core-Upgrade Access for Non-Superadmin Admins

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120487

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LaraDashboard LaraDashboard 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in LaraDashboard before version 1.4.5 allows non-Superadmin administrators with the settings.edit permission to perform Superadmin-only core upgrade operations. The flaw exists in the SettingPolicy::manageCoreUpgrades() function, which incorrectly grants access to backup, download, restore, and upgrade actions via the /admin/settings/core-upgrades endpoint. Attackers can exploit this to access database dumps containing password hashes or perform unauthorized site restores and upgrades.

Detection Guidance

Check if your LaraDashboard version is below 1.4.5. Inspect the SettingPolicy.php file for improper permission checks in manageCoreUpgrades(). Look for unauthorized access attempts to /admin/settings/core-upgrades endpoints. Review logs for backup, download, restore, or upgrade actions performed by non-Superadmin users.

Impact Analysis

An attacker with Admin privileges could exfiltrate sensitive data like password hashes, API keys, or application secrets. They could also restore or upgrade the site without authorization, potentially overwriting existing data or executing arbitrary code through upgrade parameters. This could lead to complete site compromise, data loss, or unauthorized access to user accounts.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade LaraDashboard to version 1.4.5 or later. Remove settings.edit permission from non-Superadmin users. Implement stricter role-based access controls. Audit logs for suspicious activities. Restrict access to /admin/settings/core-upgrades endpoints to Superadmin only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120487. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...