EUVD-2026-115222

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download,...

CVE-2026-120487

LaraDashboard versions prior to 1.4.5 are affected by an incorrect authorization vulnerability in the SettingPolicy::manageCoreUpgrades() function. This flaw allows non-Superadmin administrators who possess settings.edit permissions to perform restricted Superadmin-only core-upgrade operations. E...