CVE-2026-90933

laradashboard through 1.2.2 Missing Authorization via License API

Published Sep 14, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys, inject attacker-controlled values, or delete stored licenses entirely.

Analysis

Technical impact

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys via GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove. This flaw means attackers with low‑privileged accounts can disclose confidential license keys, inject attacker‑controlled values, or delete stored licenses, compromising the confidentiality and integrity of licensing data. The weakness is an authorization flaw (CWE‑862).

Affected Systems

The vulnerability applies to laradashboard version 1.2.2 and all earlier releases, as inferred from the presence of the Local License API in these versions. Every installation that exposes the /api/admin/licenses/* endpoints is affected and should be assessed for the presence of the vulnerable routes.

Risk and Exploitability

The CVSS score of 7.1 indicates moderate to high risk. Exploitation requires only an authenticated account, making the vulnerability highly exploitable in environments with many intermediate‑privilege users. The EPSS score is not available, indicating no specific data on exploitation likelihood. The issue is not listed in CISA’s KEV catalog. The likely attack vector is an internal or local user with a low‑privileged account accessing the exposed Local License API endpoints, leading to loss of confidential license keys and potential disruption of licensing operations, with no known privilege escalation beyond the authenticated scope.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

laradashboard

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.2.2

No data.

Vendor Product Versions

Laradashboard

Lara Dashboard

Version	Status	Scheme	Platform
`[0,1.2.2]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade laradashboard to a version newer than 1.2.2 where the authorization fix has been applied.
If an upgrade cannot be performed immediately, block or restrict access to the /api/admin/licenses/* endpoints so that only fully‑authorized administrator accounts or trusted IP addresses can reach them.
Remove or disable the Local License API routes from the application configuration until a patched version is deployed.

Generated by OpenCVE AI on September 15, 2026 at 14:12 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.301% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j4m5-rrc4-5qv6
https://www.vulncheck.com/advisories/laradashboard-through-1.2.2-missing-authorization-via-license-api

History

Sep 14, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 14, 2026 1:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys, inject attacker-controlled values, or delete stored licenses entirely.
Title		laradashboard through 1.2.2 Missing Authorization via License API
First Time appeared		Laradashboard Laradashboard lara Dashboard
Weaknesses		CWE-862
CPEs		cpe:2.3:a:laradashboard:lara_dashboard::::::::
Vendors & Products		Laradashboard Laradashboard lara Dashboard
References		https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j4m5-rrc4-5qv6 https://www.vulncheck.com/advisories/laradashboard-through-1.2.2-missing-authorization-via-license-api
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}`