CVE-2026-86436: Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints
Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chosen extensions to the public web root and execute code if the deployment permits execution of the uploaded file type.
Affected Software
Event History
Frequently Asked Questions
Which accounts can exploit the upload endpoints?
Any authenticated Lara Dashboard account that lacks content permissions may still upload files through the affected post-builder image and video upload endpoints. No user interaction is required.
When can this lead to code execution?
Code execution depends on the deployment allowing execution of the attacker-chosen uploaded file type from the public web root. The issue allows upload of polyglot files with attacker-chosen extensions, but execution is not implied in every deployment.
What versions are affected?
Lara Dashboard versions before 1.3.2 are affected.