CVE-2026-105126

Name of the Vulnerable Software and Affected Versions LaraDashboard versions prior to 1.4.8

Description Improper privilege management allows authenticated Admin users to escalate their privileges to Superadmin by editing or renaming roles. An attacker possessing the role.edit permission can rename their own role to Superadmin or grant themselves user.login as permissions. This allows for account takeover and access to core upgrade and module installation functions, which can lead to remote code execution.

Recommendations Update to version 1.4.8 or later. Restrict the use of the role.edit permission to trusted administrators only.