{"id":"CVE-2026-120488","kind":"vulnerability","aliases":["CVE-2026-120488"],"related":[],"title":"LaraDashboard: stored script injection through page builder blocks hits admin sessions","description":"LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save text-editor, HTML, text or heading blocks containing script or event-handler markup that executes in administrator or Superadmin sessions viewing the builder, preview or page.","summary":"LaraDashboard before 1.4.9 does not sanitize content in its LaraBuilder design blocks, so a user with post create or edit permission can save script markup that stores in the page. When an administrator or Superadmin opens the builder, preview or page, that script runs in their session.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["laradashboard","laravel","other","self-hosted"],"not_affected_if":["only-trusted-editors","version-1.4.9-or-later"],"how_to_check":"- Check the installed LaraDashboard version and confirm it is `1.4.9` or later.\n- Look for users who hold `post.create` or `post.edit` permission and confirm they are trusted.\n- Review saved LaraBuilder `design_json` blocks for script or event-handler markup.","fix":"- Move LaraDashboard to `1.4.9` or later.","status":"open","published_at":"2026-11-02T15:17:30+00:00","first_seen_at":"2026-11-02T15:24:04+00:00","triaged_at":"2026-11-02T15:26:23+00:00","updated_at":"2026-11-02T15:26:23+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-02T15:26:23Z","model":"claude-haiku-5-5","output":{"fix":"- Move LaraDashboard to `1.4.9` or later.","reach":"network","title":"LaraDashboard: stored script injection through page builder blocks hits admin sessions","impact":"medium","summary":"LaraDashboard before 1.4.9 does not sanitize content in its LaraBuilder design blocks, so a user with post create or edit permission can save script markup that stores in the page. When an administrator or Superadmin opens the builder, preview or page, that script runs in their session.","audience":"businesses","category":"other","nicknames":[],"who_cares":["laravel","laradashboard","self-hosted"],"confidence":0.75,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in admin sessions, enabling session or account takeover","analyst_note":"","how_to_check":"- Check the installed LaraDashboard version and confirm it is `1.4.9` or later.\n- Look for users who hold `post.create` or `post.edit` permission and confirm they are trusted.\n- Review saved LaraBuilder `design_json` blocks for script or event-handler markup.","plain_action":"","needs_analyst":false,"not_affected_if":["version-1.4.9-or-later","only-trusted-editors"],"who_is_affected":"Teams that run LaraDashboard below 1.4.9 and give content editing rights (post.create or post.edit) to people beyond trusted staff. The risk is to administrators and Superadmins who open pages in the builder or preview. Installations on 1.4.9 or later, or where only fully trusted editors can change content, are lower risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4268,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120488':14A,17A '-2026':13A,16A '1.4.9':26B,73C 'admin':10A 'administr':56B,122C 'allow':83C 'attack':101C 'authent':84C 'block':8A,35B,99C,111C 'builder':7A,61B,128C 'contain':74C,112C 'content':30B,100C 'creat':41B 'cross':78C 'cross-sit':77C 'cve':12A,15A 'design':34B,97C 'edit':43B 'editor':106C 'event':116C 'event-handl':115C 'execut':120C 'handler':117C 'head':110C 'hit':9A 'host':23B 'html':107C 'inject':4A,92C 'json':98C 'larabuild':33B,96C 'laradashboard':1A,18B,24B,71C 'laravel':19B 'markup':48B,118C 'open':59B 'page':6A,53B,64B,131C 'permiss':44B,90C 'post':40B 'post.create':87C 'post.edit':89C 'preview':62B,129C 'run':67B 'sanit':29B 'save':46B,103C 'script':3A,47B,66B,80C,93C,113C 'self':22B 'self-host':21B 'session':11A,70B,125C 'site':79C 'store':2A,50B,76C 'superadmin':58B,124C 'text':105C,108C 'text-editor':104C 'unsanit':95C 'user':38B,85C 'via':94C 'view':126C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Teams that run LaraDashboard below 1.4.9 and give content editing rights (post.create or post.edit) to people beyond trusted staff. The risk is to administrators and Superadmins who open pages in the builder or preview. Installations on 1.4.9 or later, or where only fully trusted editors can change content, are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["laradashboard","laravel","medium","other","selfhosted"],"first_public_at":"2026-11-01T19:00:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120488","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120488","severity":null,"published_at":"2026-11-02T15:17:30+00:00","modified_at":"2026-11-02T15:17:30+00:00","first_seen_at":"2026-11-02T15:24:04+00:00","fetched_at":"2026-11-02T15:24:04+00:00","note":null}],"documents":[{"id":52491,"url":"https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52492,"url":"https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":52527,"url":"https://github.com/laradashboard/laradashboard/security/advisories/GHSA-9gg9-jh9p-fw37","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-01T19:00:22+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":52528,"url":"https://github.com/laradashboard/laradashboard/security/advisories/GHSA-rf5h-55h2-jmf8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-01T19:01:35+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":52529,"url":"https://github.com/laradashboard/laradashboard/security/advisories/GHSA-w878-x2w9-3r6f","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-01T19:02:02+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":52530,"url":"https://www.vulncheck.com/advisories/laradashboard-before-1.4.9-stored-xss-via-larabuilder-design-json-block-content","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}