🔐 CVE Alert

CVE-2026-105126

HIGH 7.2

LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering

CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th

LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.login_as permissions to take over accounts and reach core upgrade and module installation functions for code execution.

CWE CWE-269
Vendor laradashboard
Product laradashboard
Published Oct 3, 2026
Stay Ahead of the Next One

Get instant alerts for laradashboard laradashboard

Be the first to know when new high vulnerabilities affecting laradashboard laradashboard are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected Versions

laradashboard / laradashboard
0 < 1.4.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/laradashboard/laradashboard/security/advisories/GHSA-555v-6rfr-r969 github.com: https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Backend/RoleController.php#L144 github.com: https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Backend/RoleController.php#L180 github.com: https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/RolePolicy.php#L39-L50 github.com: https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Requests/CoreUpgrade/UploadRequest.php#L23 github.com: https://github.com/laradashboard/laradashboard/pull/344 github.com: https://github.com/laradashboard/laradashboard/commit/286f150e4d0c924ec1ce7eb256b2326e871e9517 github.com: https://github.com/laradashboard/laradashboard/releases/tag/v1.4.8 github.com: https://github.com/laradashboard/laradashboard vulncheck.com: https://www.vulncheck.com/advisories/laradashboard-before-1.4.8-privilege-escalation-via-superadmin-role-tampering

Credits

EVIL0RD