CVE-2026-120487

HIGH 7.2

LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.

CWE	CWE-863
Vendor	laradashboard
Product	laradashboard
Published	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for laradashboard laradashboard

Be the first to know when new high vulnerabilities affecting laradashboard laradashboard are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

LaraDashboard / LaraDashboard

0 < 1.4.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/laradashboard/laradashboard/security/advisories/GHSA-rjjq-v76w-8jh4 github.com: https://github.com/laradashboard/laradashboard/commit/fdb77b898e6bb0a0df82bbf979c2bfba38a81532 github.com: https://github.com/laradashboard/laradashboard/releases/tag/v1.4.5 github.com: https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/SettingPolicy.php#L47-L50 vulncheck.com: https://www.vulncheck.com/advisories/laradashboard-before-1.4.5-incorrect-authorization-via-settingpolicy-core-upgrades

Credits

EVIL0RD