CVE-2026-86438: Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action
Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lara Dashboardto a version that resolves this vulnerability.Fixed in 1.3.2 - Configuration
Update Lara Dashboard so the MarketplaceModuleBrowser installModule Livewire action enforces proper authorization; non-Superadmin administrators must not be able to install modules.
Lara Dashboard Marketplace module install (MarketplaceModuleBrowser installModule Livewire action) authorization for installModule Livewire action = require Superadmin (block non-Superadmin administrators)
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated administrator who is not a Superadmin can exploit the missing authorization on the MarketplaceModuleBrowser installModule Livewire action. Exploitation does not require user interaction.
What is required for exploitation to lead to code execution?
The attacker needs administrator-level access to invoke the install action and install a marketplace module. The affected action downloads and automatically activates arbitrary PHP modules over unsigned HTTP requests, which can result in remote code execution.
Which versions are affected?
Lara Dashboard versions before 1.3.2 are affected. Upgrading to 1.3.2 or later addresses the stated vulnerable version range.