CVE-2026-120487: LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades
Published Nov 2, 2026
·Updated
LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.
Event History
Nov 2, 2026
CVE Published
via OSV·02:29 PM
Data Sourced
via OSV·02:29 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness