Missing Authorization in Laradashboard Local License API

Executive Summary

CVE-2026-90933 is a missing authorization vulnerability in laradashboard through version 1.2.2. It allows any authenticated user, including low-privileged accounts, to read, overwrite, or delete premium module license keys via three API endpoints that lack proper permission checks.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to the vulnerable API endpoints by monitoring logs for GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove requests from low-privileged users. Review application logs for any suspicious activity involving license key modifications or deletions.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to disclose confidential license keys, inject malicious values into licenses, or delete stored licenses entirely. This could lead to unauthorized access, financial loss, or disruption of premium module functionality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive license keys. GDPR requires protection of personal and confidential data, while HIPAA mandates safeguarding protected health information. Exposure or deletion of license keys may violate these regulations by compromising data integrity and confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Update laradashboard to a patched version beyond 1.2.2. If an update is unavailable, restrict access to the vulnerable endpoints by implementing proper authorization checks in the Form Requests. Remove hardcoded authorize() methods that return true and enforce role-based access control.

Useful 0 Not Useful 0