CVE-2026-120487

EUVD-2026-115222
LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/SettingPolicy.php#L47-L50
https://github.com/laradashboard/laradashboard/commit/fdb77b898e6bb0a0df82bbf979c2bfba38a81532
https://github.com/laradashboard/laradashboard/releases/tag/v1.4.5
https://github.com/laradashboard/laradashboard/security/advisories/GHSA-rjjq-v76w-8jh4
https://www.vulncheck.com/advisories/laradashboard-before-1.4.5-incorrect-authorization-via-settingpolicy-core-upgrades