CVE-2026-120487— LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades

Quick assessment

Affected

LaraDashboard LaraDashboard

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LaraDashboard 1.4.5 之前的版本在方法中存在一个授权错误漏洞。该漏洞允许拥有权限的非超级管理员访问仅限超级管理员使用的核心升级操作。攻击者可利用路径下的备份、下载、恢复和升级功能，获取包含密码哈希值的数据库转储文件，并进一步恢复或升级网站。

CVSS 7.2 · High Updated Nov 02, 2026

Possible ATT&CK Techniques 3 AI

T1078 · Valid Accounts T1027 · Obfuscated Files or Information T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades

Source: CVE Program / CVE List V5

Vulnerability Description

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
LaraDashboard	LaraDashboard	0 ~ 1.4.5	-

II. Public POCs for CVE-2026-120487

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120487

请登录查看更多情报信息。

Other References for CVE-2026-120487 (5)

https://github.com/laradashboard/laradashboard/commit/fdb77b898e6bb0a0df82bbf979c2bfba38a81532 patch
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/SettingPolicy.php#L47-L50 technical-description
https://github.com/laradashboard/laradashboard/releases/tag/v1.4.5 release-notes
https://github.com/laradashboard/laradashboard/security/advisories/GHSA-rjjq-v76w-8jh4 vendor-advisory
https://www.vulncheck.com/advisories/laradashboard-before-1.4.5-incorrect-authorization-via-settingpolicy-core-upgrades third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120487

Same Patch Batch · LaraDashboard · 2026-11-02 · 3 CVEs total

CVE-2026-120488	5.4 MEDIUM	LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content
CVE-2026-120450	4.3 MEDIUM	LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool

IV. Related Vulnerabilities

Same product: LaraDashboard

Same vendor: LaraDashboard

Same weakness: CWE-863