CVE-2026-90933 in LaraDashboard
Summary
by MITRE • 09/14/2026
laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys, inject attacker-controlled values, or delete stored licenses entirely.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in Laradashboard versions through 1.2.2 represents a critical failure in access control mechanisms within the application's administrative API layer. Specifically, this flaw affects the Local License API endpoints which are designed to manage premium module license keys. The core issue is a missing authorization check that fails to verify whether the authenticated user possesses the necessary privileges to perform operations on these sensitive resources. Consequently, any user who has successfully authenticated to the system, regardless of their role or permission level, can interact with administrative functions intended exclusively for high-privileged administrators. This type of vulnerability falls under CWE-284 Improper Access Control and is often associated with CWE-862 Missing Authorization in standard classification systems.
The technical manifestation of this flaw allows attackers to exploit three specific API endpoints: GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove. By targeting the show endpoint, an attacker can retrieve existing license keys that are typically considered confidential intellectual property or commercial secrets belonging to the organization or its customers. The store endpoint permits the injection of arbitrary data, allowing a low-privileged user to overwrite legitimate license configurations with maliciously crafted values. This could lead to unauthorized activation of premium features by external parties or disruption of service if invalid licenses are injected. Furthermore, the remove endpoint enables the complete deletion of stored license records, which can cause denial of service for users relying on those specific modules and disrupt business operations that depend on continuous access to premium functionality.
From an operational perspective, this vulnerability poses significant risks including data confidentiality breaches, integrity compromise, and availability disruption. The disclosure of license keys undermines commercial models based on software licensing and may facilitate unauthorized distribution or resale of proprietary code. Overwriting licenses can lead to financial loss if attackers activate paid features without proper authorization, while deletion attacks can halt critical workflows dependent on the affected modules. In terms of threat modeling, this behavior aligns with ATT&CK technique T1078 Valid Accounts, where adversaries use legitimate credentials to access resources they are not authorized for, and potentially T1496 Resource Hijacking if the compromised licenses are used to mine cryptocurrency or host malicious content using the victim's infrastructure.
Mitigation strategies must focus on implementing robust role-based access control checks at both the application logic level and the API gateway layer. Developers should ensure that all administrative endpoints enforce strict verification of user roles before processing requests, utilizing middleware or decorators that explicitly check for administrator privileges rather than relying solely on authentication status. Additionally, input validation should be strengthened to prevent injection attacks through the store endpoint, ensuring that only valid license formats are accepted and that changes are logged for audit purposes. Regular security audits and penetration testing focusing on broken access control scenarios are recommended to identify similar gaps in other parts of the application. Updating to a patched version where these authorization checks have been properly implemented is essential for restoring secure operations.