CVE-2026-86437: Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload
Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which execute as the web server user with access to environment secrets and database credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lara Dashboardto a version that resolves this vulnerability.Fixed in 1.3.2 - Configuration
Fix the incorrect authorization for the core-upgrade archive upload endpoint so only Superadmin administrators can upload and extract core-upgrade zip archives.
Lara Dashboard Authorization for POST /admin/settings/core-upgrades/upload = Require Superadmin authorization (do not allow settings.edit-only admins)
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any non-Superadmin administrator granted the settings.edit permission can access the affected upload endpoint. Exploitation does not require user interaction.
What level of access can a successful attacker obtain?
An attacker can replace application files through a crafted ZIP archive and execute embedded system commands when the modified code runs. Commands execute as the web server user, which may have access to environment secrets and database credentials.
What is the affected endpoint and authorization condition?
The affected endpoint is POST /admin/settings/core-upgrades/upload. Before 1.3.2, it checks only for the settings.edit permission rather than requiring Superadmin-level authorization.