CVE-2026-86438 in Lara Dashboard
Summary
by MITRE • 09/08/2026
Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote code execution.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in Lara Dashboard versions prior to 1.3.2 represents a critical failure in access control mechanisms within the application's module management subsystem. Specifically, the Livewire action responsible for installing modules via the MarketplaceModuleBrowser endpoint lacks proper authorization checks. This flaw allows any authenticated user with administrative privileges, excluding only Superadmins, to execute code that installs arbitrary PHP modules from the marketplace. The core issue lies in the server-side validation logic which fails to verify whether the requesting user possesses the specific permissions required to perform installation operations, effectively treating all administrator roles as equivalent regarding module deployment capabilities.
From a technical perspective, this is a classic example of Broken Access Control where the application relies on client-side restrictions or insufficient server-side role verification rather than enforcing strict privilege separation. The vulnerability enables non-Superadmin administrators to bypass intended security boundaries by directly invoking the installModule Livewire action. Because the system does not validate the user's specific role against the required permissions for this operation, it proceeds with the installation process regardless of the requester's actual authority level. This design flaw undermines the principle of least privilege and allows lower-privileged accounts to perform high-risk administrative tasks intended exclusively for superusers.
The operational impact of this vulnerability is severe due to the nature of the actions permitted by the exploit. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests. The lack of signature verification on these requests further exacerbates the risk, as it allows for potential man-in-the-middle attacks or request manipulation if transmitted over unencrypted channels. Once a malicious module is installed and activated, it executes within the context of the web server process. This typically results in Remote Code Execution (RCE), granting the attacker full control over the underlying system. The ability to auto-activate modules means that no additional user interaction is required post-installation, facilitating immediate exploitation upon successful authentication by a compromised administrative account.
This vulnerability aligns with CWE-862, which describes Missing Authorization, as the application fails to enforce proper access controls on critical functions. Furthermore, it maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter under Execution, specifically through PHP scripts, allowing attackers to execute arbitrary code. The use of unsigned HTTP requests also relates to CWE-319 Cleartext Transmission of Sensitive Information if the marketplace communication is not encrypted, although the primary severity stems from the unauthorized installation capability itself.
Mitigation strategies must focus on implementing robust server-side authorization checks for all administrative actions involving module management. Developers should ensure that the MarketplaceModuleBrowser installModule action explicitly verifies that the requesting user holds Superadmin privileges before proceeding with any file system operations or package installations. Additionally, integrating cryptographic signature verification for marketplace requests would enhance integrity and authenticity assurances. Upgrading to version 1.3.2 or later is essential as it addresses these access control deficiencies by enforcing stricter role-based permissions and securing the module installation pipeline against unauthorized modifications.