rootpwn

high · CVSS v3 7.2 · CVSS v4 8.6 · EPSS 0.00493

CVE-2026-105126

LaraDashboard versions before 1.4.8 have a privilege escalation flaw that lets authenticated Admin users gain Superadmin rights by editing o

Overview

LaraDashboard versions before 1.4.8 have a privilege escalation flaw that lets authenticated Admin users gain Superadmin rights by editing or renaming roles. This allows attackers to access core upgrade and module installation functions, potentially leading to code execution. The vulnerability is exploitable by users with role.edit permissions.

Description

LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.login_as permissions to take over accounts and reach core upgrade and module installation functions for code execution.

Impact

Confidentiality, Integrity, and Availability are at risk for organizations running vulnerable LaraDashboard installations. Admin users can elevate privileges to Superadmin, enabling unauthorized code execution and system compromise. Defenders should treat this as a high-impact privilege escalation threat.

Remediation

Apply the official patch to upgrade to version 1.4.8 or later. If patching is not immediately possible, restrict role.edit permissions to trusted users, disable role renaming features, and enforce least privilege on role management. Monitor for unauthorized role changes and audit logs.

Risk context

Severity is high with CVSS v3 7.2 and v4 8.6, but EPSS 0.00493 indicates low probability of exploitation in the wild. Nonetheless, the potential impact warrants prompt patching or mitigation.

Affected products

  • LaraDashboard

Scores

Severity
high
CVSS v2
8.3
CVSS v3
7.2
CVSS v4
8.6
EPSS
0.00493

privilege-escalation role-management admin code-execution LaraDashboard high-severity

← All CVEs

Related CVEs

high

CVE-2026-88782

The Kubio AI Page Builder WordPress plugin (v<2.9.3) fails to validate URI schemes in user-supplied link targets, enabling stored XSS. Contributors and higher can inject malicious payloads that execute in the browsers of anyone who clicks the link, including administrators previewing drafts. This flaw can lead to session hijacking or defacement.

View analysis

high

CVE-2026-97935

A use‑after‑free bug in the Linux kernel tracing subsystem allows a malformed histogram trigger to corrupt the named_triggers list. The flaw occurs when an invalid clock string is supplied, causing the trigger to be registered before the clock is validated. This can lead to kernel memory corruption and potential privilege escalation.

View analysis

high

CVE-2026-105129

LaraDashboard before 1.4.8 contains an authorization flaw that allows users with only settings.view permission to read sensitive secrets via the settings API. This exposes AI provider keys, mail credentials, passwords, and tokens to any authenticated user. The vulnerability can be exploited by any user who has logged in.

View analysis

high

CVE-2026-105133

A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate this issue. It is recommended to upgrade the affected component.

View analysis