CVE-2026-90933— laradashboard through 1.2.2 Missing Authorization via License API
Quick assessment
Affected
laradashboard laradashboard
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LaraDashboard 1.2.2 及更早版本存在一个授权缺失漏洞，位于本地许可证（Local License）API 端点。该漏洞允许任何已认证用户读取、覆盖和删除高级模块的许可证密钥。低权限账户的攻击者可以通过访问以下端点来泄露机密许可证密钥、注入攻击者可控的值，或完全删除已存储的许可证： GET /api/admin/licenses/show POST /api/admin/licenses/store POST /api/admin/licenses/remove
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90933
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
laradashboard through 1.2.2 Missing Authorization via License API
Source: CVE Program / CVE List V5
Vulnerability Description
laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys, inject attacker-controlled values, or delete stored licenses entirely.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| laradashboard | laradashboard | 0 ~ 1.2.2 | - |
|
II. Public POCs for CVE-2026-90933
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90933
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-90933 (2)
Same Patch Batch · laradashboard · 2026-09-14 · 3 CVEs total
| CVE-2026-90932 | 7.2 HIGH | LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE |
| CVE-2026-90931 | 5.4 MEDIUM | LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload |
IV. Related Vulnerabilities
Same product: laradashboard
-
CVE-2026-90931
LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload -
CVE-2026-90932
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE -
CVE-2026-87821
Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forge -
CVE-2026-86437
Lara Dashboard before 1.3.2 Incorrect Authorization in Core- -
CVE-2026-86438
Lara Dashboard before 1.3.2 Missing Authorization in Marketp
Same vendor: laradashboard
-
CVE-2026-90931
LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload -
CVE-2026-90932
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE -
CVE-2026-87821
Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forge -
CVE-2026-86437
Lara Dashboard before 1.3.2 Incorrect Authorization in Core- -
CVE-2026-86438
Lara Dashboard before 1.3.2 Missing Authorization in Marketp
Same weakness: CWE-862
-
CVE-2026-82437
Apache Storm Logviewer: Log Access Controls Not Enforced by -
CVE-2026-90941
novel-plus through 5.3.3 Missing Authorization on the Admin -
CVE-2026-90939
novel-plus through 5.3.3 Missing Authorization on the Admin -
CVE-2026-75030
Apache Syncope: Incomplete authorization checks for Group me -
CVE-2026-8821
Playbooks run owner channel membership permission bypass
V. Comments for CVE-2026-90933
No comments yet