CVE-2026-120487

High

Description

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.

SeverityHigh

CVSS7.2

Exploit probability—

ProductLaraDashboard

PublishedNov 2, 2026

First seenNov 4, 2026

Weakness typeCWE-863Incorrect authorization

How to fix

Update

LaraDashboard LaraDashboard1.4.5 or later

Patches

github.com/laradashboard/laradashboard/commit/fdb77b898e6bb0a0df82bbf979c2bfba38a81532

Vendor advisories

Affected products

Product	Affected versions	Fixed in
LaraDashboard LaraDashboard	v < 1.4.5	1.4.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.