---
id: CVE-2026-120487
title: >-
  LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core
  Upgrades
summary: >-
  LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability
  in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin
  administrators with settings.edit to access Superadmin-only core-upgrade
  operations. Attackers…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-863
vendor: LaraDashboard
product: LaraDashboard
affected:
  - LaraDashboard < 1.4.5
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T14:29:17.874Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120487'
references:
  - url: >-
      https://github.com/laradashboard/laradashboard/security/advisories/GHSA-rjjq-v76w-8jh4
    label: GitHub Security Advisory (GHSA-rjjq-v76w-8jh4)
  - url: >-
      https://github.com/laradashboard/laradashboard/commit/fdb77b898e6bb0a0df82bbf979c2bfba38a81532
  - url: 'https://github.com/laradashboard/laradashboard/releases/tag/v1.4.5'
    label: LaraDashboard v1.4.5 Release Notes
  - url: >-
      https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/SettingPolicy.php#L47-L50
  - url: >-
      https://www.vulncheck.com/advisories/laradashboard-before-1.4.5-incorrect-authorization-via-settingpolicy-core-upgrades
    label: >-
      VulnCheck Advisory: LaraDashboard before 1.4.5 Incorrect Authorization via
      SettingPolicy Core Upgrades
tags:
  - cve.org
epss: 0.00484
epssPercentile: 0.41807
ingestedAt: '2026-11-05T19:30:42.661Z'
---

## Overview

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.

## Affected

- `LaraDashboard < 1.4.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.