Technical impact
The vulnerability in LaraDashboard prior to version 1.4.8 permits authenticated administrators to manipulate role definitions. By renaming their role to Superadmin or granting themselves the user.login_as capability, an attacker can elevate privileges within the application. This escalation opens access to core upgrade and module installation endpoints, site‑wide configuration changes, and potentially arbitrary code execution. The flaw stems from incorrect privilege checks when editing roles, classified as an improper privilege management weakness (CWE‑269).
Affected Systems
The issue affects all installations of LaraDashboard from the start through version 1.4.7, inclusive. Affected vendors are the laradashboard project itself, and installations running any build prior to the 1.4.8 release. No specific build numbers are listed beyond the pre‑1.4.8 range.
Risk and Exploitability
The vulnerability carries a CVSS score of 8.6 indicating high severity. No EPSS score is available, so the exploitation probability cannot be quantified here, and the issue is not currently listed in the CISA KEV catalog. The attack can be carried out by any authenticated user who has the role.edit permission, which is typically granted to Admin accounts. Because the escalation relies on in‑application role modification, the threat is limited to users with legitimate application access but can lead to full system compromise once the attacker gains superadmin status.
