---
id: "CVE-2026-120487"
kind: "vulnerability"
aliases: ["CVE-2026-120487"]
title: "LaraDashboard: non-superadmin users can run core upgrades and dump database"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["laradashboard", "laravel", "package", "self-hosted"]
not_affected_if: ["already-on-1.4.5-or-later", "only-superadmins-hold-settings-edit"]
published_at: "2026-11-02T15:17:30+00:00"
first_seen_at: "2026-11-02T15:24:04+00:00"
updated_at: "2026-11-02T15:25:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120487", "first_seen_at": "2026-11-02T15:24:04+00:00"}]
---

# LaraDashboard: non-superadmin users can run core upgrades and dump database

LaraDashboard before 1.4.5 has an authorization flaw in SettingPolicy::manageCoreUpgrades() that lets administrators with settings.edit reach superadmin-only core-upgrade actions. An attacker with that role can download database dumps containing password hashes and restore or upgrade the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed LaraDashboard version in composer.lock or the project's package metadata; anything below `1.4.5` is affected.
- Review which accounts hold the settings.edit permission and whether any non-superadmin admin has it.
- Look for access to `/admin/settings/core-upgrades` in web server logs from non-superadmin accounts.

## Fix

- LaraDashboard: upgrade to `1.4.5` or later.

## Timeline

- 2026-11-02T15:24:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120487

## Documents

- [advisory] Vendor advisory: github.com https://github.com/laradashboard/laradashboard/security/advisories/GHSA-rjjq-v76w-8jh4
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/laradashboard-before-1.4.5-incorrect-authorization-via-settingpolicy-core-upgrades
- [fix] Patch: github.com https://github.com/laradashboard/laradashboard/commit/fdb77b898e6bb0a0df82bbf979c2bfba38a81532
- [fix] Release notes: github.com https://github.com/laradashboard/laradashboard/releases/tag/v1.4.5

## From the sources

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_