CVE-2026-120487 in LaraDashboard
Summary
by MITRE • 11/02/2026
LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in LaraDashboard versions prior to 1.4.5 represents a critical failure in role-based access control mechanisms within the application's administrative interface. Specifically, the flaw resides in the SettingPolicy::manageCoreUpgrades() function, which is responsible for determining whether an authenticated user possesses the necessary permissions to execute core upgrade operations. In a properly secured system, actions such as managing database backups, downloading sensitive data archives, restoring site configurations, and performing software upgrades should be strictly reserved for Superadmin users who hold elevated privileges. However, due to incorrect authorization logic, this function erroneously grants access to these high-impact capabilities to any administrator role that possesses the settings.edit permission. This misconfiguration effectively bypasses the intended privilege separation model, allowing lower-level administrators to perform tasks that are typically restricted to the highest level of system authority.
From a technical perspective, the root cause is an insufficient check within the authorization policy layer. The application fails to verify if the requesting user holds the specific Superadmin role or equivalent high-privilege status before permitting access to the core upgrade endpoints. Instead, it relies on a broader permission set that includes settings.edit, which is intended for general configuration management but was incorrectly mapped to include administrative system maintenance tasks. This architectural oversight means that any user account with the ability to edit site settings can also interact with sensitive backend operations such as initiating database dumps or restoring full system states. The vulnerability affects multiple endpoints associated with backup and upgrade processes, including actions for backing up data, downloading these backups, restoring from them, and executing core upgrades.
The operational impact of this vulnerability is severe, primarily due to the potential for unauthorized access to sensitive data and complete compromise of application integrity. By exploiting the ability to download database dumps, an attacker with settings.edit privileges can extract comprehensive information stored in the database, including user credentials, password hashes, session tokens, and potentially other confidential business logic or personal identifiable information. The exposure of password hashes facilitates offline brute-force attacks, which may lead to further credential compromise across the system if weak hashing algorithms are used. Furthermore, the ability to restore backups allows an attacker to revert the application to a previous state that might contain known vulnerabilities or malicious code previously injected by other compromised accounts. Additionally, the capability to perform core upgrades can be abused to install backdoors or modify critical files under the guise of legitimate maintenance activities, thereby establishing persistent access and full control over the server environment.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves a failure to enforce appropriate restrictions on users based on their assigned roles. It also maps closely to MITRE ATT&CK technique T1078, Valid Accounts, specifically in the context of using legitimate administrative credentials for unauthorized purposes due to flawed access controls. The exploitation path resembles aspects of CWE-284, Improper Access Control, where an actor exploits a design flaw to gain privileges they should not have.
To mitigate this vulnerability, organizations running LaraDashboard versions before 1.4.5 must immediately upgrade to version 1.4.5 or later, which contains the corrected authorization logic that properly restricts core upgrade operations to Superadmin roles only. For environments where immediate upgrading is not feasible, administrators should review and tighten role definitions by removing the settings.edit permission from any non-Superadmin accounts if those permissions are not strictly necessary for their daily tasks. Additionally, implementing strict monitoring of administrative actions can help detect unusual activity patterns associated with unauthorized backup downloads or restoration attempts. Regular audits of user roles and permissions are essential to ensure that privilege escalation paths remain closed and that the principle of least privilege is consistently applied across all administrative functions.