CVE-2026-90933
HighCVSS 7.1Summary
laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys, inject attacker-controlled values, or delete stored licenses entirely.
Risk Assessment
A low-privileged user can disclose, modify, or delete premium license keys, leading to loss of license control and potential financial loss. This may also allow injection of unauthorized values into the system.
Recommendation
Upgrade laradashboard to a version with the authorization fix. Until then, restrict access to license endpoints and enforce server-side permission checks.
Other vulnerabilities in laradashboard
See all- CVE-2026-90932High
LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in core-upgrade backup handling. CoreUpgradeController and BackupService concatenate the user-supplied backup_file/filename value directly onto the backup directory path without normalization, without basename(), and without verifying the resolved path stays inside storage/app/core-backups. An authenticated user with only settings.edit permission can use ../ sequences to delete arbitrary files or restore a ZIP archive from an arbitrary location, leading to remote code execution.
- CVE-2026-90931Medium
LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline from the application origin, the embedded JavaScript executes in the dashboard context, enabling session hijacking and administrative account takeover.
Original NVD description (English source)
laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys, inject attacker-controlled values, or delete stored licenses entirely.