Live › vulnerability › CVE-2026-120487
LaraDashboard before 1.4.5 has an authorization flaw in SettingPolicy::manageCoreUpgrades() that lets administrators with settings.edit reach superadmin-only core-upgrade actions. An attacker with that role can download database dumps containing password hashes and restore or upgrade the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Sites running LaraDashboard before 1.4.5 where some administrators hold settings.edit without being superadmins. The exposed path is the core-upgrade section of the admin settings. Sites where only superadmins can edit settings are less exposed, but the fix is still the version upgrade.
No product ranges from the sources yet.
1.4.5 is affected./admin/settings/core-upgrades in web server logs from non-superadmin accounts.1.4.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.
This page as .md · .json · in your agent: get_signal("CVE-2026-120487")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.