CVE-2026-120487

Name of the Vulnerable Software and Affected Versions LaraDashboard versions prior to 1.4.5

Description An incorrect authorization issue exists in the manageCoreUpgrades() function within SettingPolicy. This allows administrators who possess the settings.edit permission, but are not Superadmins, to perform core-upgrade operations reserved for Superadmins. By interacting with the '/admin/settings/core-upgrades' endpoint, an attacker can execute backup, download, restore, and upgrade actions, potentially leading to the acquisition of database dumps containing password hashes or unauthorized site restoration and upgrades.

Recommendations Update LaraDashboard to version 1.4.5 or later.