Skip to content
OpenAdvisories

Vendor

LaraDashboard

18 known vulnerabilities.

Products

LaraDashboard 18
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.2
    CVE-2026-120487

    LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades

    LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/se…

    LaraDashboard LaraDashboard
  • High 7.2
    CVE-2026-105126

    LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering

    LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.login_a…

    LaraDashboard LaraDashboard
  • High 7.1
    CVE-2026-90933

    laradashboard through 1.2.2 Missing Authorization via License API

    laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET …

    LaraDashboard LaraDashboard
  • High 7.2
    CVE-2026-90932 Public exploit

    LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE

    LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService (e.g. BackupService::deleteBackup()) concatenate the user-supplied backup_file/filename value direct…

    LaraDashboard LaraDashboard
  • High 7.1
    CVE-2026-87821

    Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

    Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP se…

    LaraDashboard LaraDashboard
  • High 7.2
    CVE-2026-86438

    Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

    Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsi…

    LaraDashboard LaraDashboard
  • High 7.2
    CVE-2026-86437

    Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload

    Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. At…

    LaraDashboard LaraDashboard
  • High 8.9
    CVE-2025-66509

    LaraDashboard: 1-Click Pre-Auth RCE via Host Header + Module Installation Chain

    LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined…

    LaraDashboard LaraDashboard