LaraDashboard lets ordinary admins use backup and upgrade controls

Site admins can steal backups holding password data from LaraDashboard.

Summary

Administrators with only the settings.edit permission can use backup, restore and upgrade actions reserved for Superadmins. They can download backups holding password hashes from the database. Versions before 1.4.5 are affected.

Affected when

Admin account with the settings.edit permission

What to do

Update to 1.4.5 or later. The release notes say core upgrade access was restricted, but the security advisory lists no patched version, so check the advisory too.

Products and platforms

LaraDashboard

CVE IDs

CVE-2026-120487 (opens in a new tab)

Sources

Advisory: github.com (opens in a new tab) · github.com (opens in a new tab)
Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)

Times

First published 2026-11-02 14:29 UTC

First seen 2026-11-09 14:10 UTC