LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.login_as permissions to take over accounts and reach core upgrade and module installation functions for code execution.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| laradashboard | laradashboard | before 1.4.8 | 1.4.8 | Patch available | CNA |
- laradashboard Vendorlaradashboard Affected before 1.4.8 Fixed in 1.4.8 Patch available CNA
Remediation
- Fix · CNA laradashboard (laradashboard) Fixed in 1.4.8
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
laradashboard 1.4.8
6 records Highest priority Priority HIGH 1 HIGH, 5 MEDIUM
Other records, highest priority first
- TI-2026-67502 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery EndpointsPriority HIGH 70
- TI-2026-67504 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings APIPriority MEDIUM 64
- TI-2026-67505 LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per-IP Registration LimitPriority MEDIUM 61
Timeline
- 2026-10-04 Threatist record created from CVE-2026-105126
- 2026-10-04 Alias added: GHSA-p2cx-3mjg-8g5h
- 2026-10-04 Priority changed: MEDIUM → LOW
- 2026-10-06 CISA SSVC decision points changed
- 2026-10-06 Priority changed: LOW → MEDIUM
References
Patch 2
Other 6
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Backend/RoleController.php#L144
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Backend/RoleController.php#L180
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/RolePolicy.php#L39-L50
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Requests/CoreUpgrade/UploadRequest.php#L23
- laradashboard v1.4.8 Release Notes
- https://github.com/laradashboard/laradashboard
More laradashboard vulnerabilities
- TI-2026-83854 LaraDashboard lets non-Superadmin admins access core upgrade actions CVSS 4.0HIGH 8.6
- TI-2026-61796 LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE CVSS 4.0HIGH 8.6
- TI-2026-59145 Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload CVSS 4.0HIGH 8.6
- TI-2026-67502 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints CVSS 4.0MEDIUM 6.9
- TI-2026-67504 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API CVSS 4.0HIGH 7.1
- TI-2026-61797 laradashboard through 1.2.2 Missing Authorization via License API CVSS 4.0HIGH 7.1
Sources
- CVE-2026-105126 · CVE Program
- CVE-2026-105126 · NVD
- FIRST EPSS
- GHSA-p2cx-3mjg-8g5h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences