CVE-2026-120487 — Vulnerability intelligence
—
Published:
- CVSS
- 8.6
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions to obtain database dumps containing password hashes and restore or upgrade the site.