Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

LaraDashboard lets admin become superadmin

CVE-2026-105126 · published 15 days ago
Summary

If you use LaraDashboard version earlier than 1.4.8, an admin who can edit roles can change their own role to superadmin or give themselves permission to log in as any user. This can let them install modules or run code they shouldn’t. Update to the latest version of LaraDashboard as soon as possible.

What to do
  • Update laradashboard laradashboard to version 1.4.8 or later.
Affected software
VendorProductAffected versions
laradashboard laradashboard < 1.4.8
Original advisory text
LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering
LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.login_as permissions to take over accounts and reach core upgrade and module installation functions for code execution.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published4 Oct 2026
Updated15 Oct 2026
First seen4 Oct 2026
Sources
CVE-2026-105126 · NVD
CVE-2026-105126 · MITRE
CVE-2026-105126 · OSV
GHSA-555v-6rfr-r969 · GHSA
Track software like this
Free during beta