What is CVE-2026-120487 in LaraDashboard?

CVE-2026-120487 is an incorrect authorization vulnerability affecting LaraDashboard prior to version 1.4.5. The security flaw resides in the SettingPolicy::manageCoreUpgrades() method, which fails to correctly enforce restrictions for non-Superadmin users.

Because of this flaw, administrators who possess the settings.edit permission can bypass intended role checks and access operations that should be strictly restricted to Superadmin roles. Similar authorization bypass issues can sometimes resemble problems found in escalada de privilegios local, although this specific vector is web-based.

Who is affected and what risks are involved?

The vulnerability impacts any deployment of LaraDashboard running versions older than 1.4.5. It carries a CVSS base score of 7.2 with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, meaning network-based attacks require high privileges.

Attackers or malicious internal users with basic administrative rights can leverage the /admin/settings/core-upgrades endpoints. This includes backup, download, restore, and upgrade actions to harvest database dumps containing password hashes, or to completely restore and take over the site.

How do I protect my system?

Securing your installation requires moving to the patched version as soon as possible. Administrators should audit user roles and apply the update immediately.

Follow these steps to mitigate the risk and update your software safely:

  1. Review existing administrator accounts and temporarily revoke the settings.edit permission from non-Superadmin users if immediate patching is not possible.
  2. Access your project environment and run composer update to fetch the latest package versions.
  3. Ensure LaraDashboard is updated to version 1.4.5 or later where SettingPolicy::manageCoreUpgrades() properly validates Superadmin privileges.
  4. Verify that backup and core upgrade endpoints return a 403 Forbidden status for unauthorized administrator roles.