CVE-2026-86437highCWE-863

CVE-2026-86437: high-severity vulnerability in laradashboard

Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload

Published · Updated

Follow this CVE+ Monitor laradashboard

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.7%
Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which execute as the web server user with access to environment secrets and database credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
laradashboard · laradashboard
Related CVEs — laradashboard

In the same product, most dangerous first.

CVE-2026-86438HIGHLara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install ActionEPSS 1.1%CVE-2026-86184CRITICALLara Dashboard before 1.3.0 Missing Authentication in screenshot-login RouteEPSS 1.1%CVE-2026-90932HIGHLaraDashboard 0.9.2 through 1.2.2 Path Traversal RCEEPSS 0.8%CVE-2026-86436MEDIUMLara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload EndpointsEPSS 0.5%CVE-2026-105127MEDIUMLaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery EndpointsEPSS 0.5%CVE-2026-105126HIGHLaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role TamperingEPSS 0.5%