The vulnerability resides in the core upgrade endpoint of LaraDashboard, where the authorization logic in SettingPolicy::manageCoreUpgrades() fails to restrict access to only Superadmin accounts. An attacker with a non‑Superadmin administrator role that possesses the settings.edit permission can invoke the backup, download, restore or upgrade functions. These functions expose the full database, allowing the attacker to obtain password hashes and to restore or upgrade the site with arbitrary content. The result is a loss of confidentiality and a severe compromise of system integrity, essentially granting a covert system takeover by a low‑privilege user.

Vendors and products affected are LaraDashboard for the LaraDashboard application. All releases prior to version 1.4.5 are vulnerable; the problem was fixed in the 1.4.5 release that was made public on the project's GitHub pages.

The CVSS score of 8.6 marks this flaw as high severity. EPSS is not provided, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation at the time of the advisory. The likely attack vector is to use the web interface or API with settings.edit access, which is commonly granted to administrators who are not Superadmins. Attacks would require the attacker to already be authenticated as an administrator, and thus the risk is confined to trusted‑but‑not‑supreme users within the organization.