Vulnerabilities

TI-2026-59146 CVE-2026-86438 · GHSA-9wqq-j933-4w98

Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

MEDIUM 41

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01101 Published 2026-09-07 Fixed in 1.3.2 CWE-862

TI-2026-59145 CVE-2026-86437 · GHSA-849q-7g6r-c83p

Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload

HIGH 72

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives ov…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00711 Published 2026-09-07 Fixed in 1.3.2 CWE-863

TI-2026-59144 CVE-2026-86436 · GHSA-v24q-8gmj-8457

Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints

MEDIUM 57

Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00529 Published 2026-09-07 Fixed in 1.3.2 CWE-862

Vulnerabilities

Filters

Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload

Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints