CVE-2026-120487
7.2 HIGHpublic exploit availablePublished 2026-11-02 · Updated 2026-11-02
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-863
Public exploit & PoC references
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/SettingPolicy.php#L47-L50
- https://github.com/laradashboard/laradashboard/commit/fdb77b898e6bb0a0df82bbf979c2bfba38a81532
- https://github.com/laradashboard/laradashboard/releases/tag/v1.4.5
- https://github.com/laradashboard/laradashboard/security/advisories/GHSA-rjjq-v76w-8jh4
All references
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/SettingPolicy.php#L47-L50
- https://github.com/laradashboard/laradashboard/commit/fdb77b898e6bb0a0df82bbf979c2bfba38a81532
- https://github.com/laradashboard/laradashboard/releases/tag/v1.4.5
- https://github.com/laradashboard/laradashboard/security/advisories/GHSA-rjjq-v76w-8jh4
- https://www.vulncheck.com/advisories/laradashboard-before-1.4.5-incorrect-authorization-via-settingpolicy-core-upgrades
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2024-22031PoC
- MEDIUMCVE-2025-13050PoC
- UNSCOREDCVE-2025-68392
- HIGHCVE-2026-100105
- MEDIUMCVE-2026-100145
- MEDIUMCVE-2026-100259
- HIGHCVE-2026-100262
- LOWCVE-2026-100270
Related by shared AI tags and CWE weakness class. Browse the full archive.