All vulnerabilities
CVE-2026-105126GHSA-555v-6rfr-r969

LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering

laradashboard laradashboard
Open in ThreatlineRecord JSON
CVSS
8.6High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.49%Chance of exploitation activity in the next 30 days, higher than 41% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.4.8Fixed versionCVE List
Published3 Oct 2026Updated 5 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.login_as permissions to take over accounts and reach core upgrade and module installation functions for code execution.

Text from CVE List

Affected versions 2

  • laradashboardaffected: all versions before 1.4.8CVE List
  • laradashboardunaffected: 1.4.8CVE List

References 10