laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys via GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove. This flaw means attackers with low‑privileged accounts can disclose confidential license keys, inject attacker‑controlled values, or delete stored licenses, compromising the confidentiality and integrity of licensing data. The weakness is an authorization flaw (CWE‑862).

The vulnerability applies to laradashboard version 1.2.2 and all earlier releases, as inferred from the presence of the Local License API in these versions. Every installation that exposes the /api/admin/licenses/* endpoints is affected and should be assessed for the presence of the vulnerable routes.

The CVSS score of 7.1 indicates moderate to high risk. Exploitation requires only an authenticated account, making the vulnerability highly exploitable in environments with many intermediate‑privilege users. The EPSS score is not available, indicating no specific data on exploitation likelihood. The issue is not listed in CISA’s KEV catalog. The likely attack vector is an internal or local user with a low‑privileged account accessing the exposed Local License API endpoints, leading to loss of confidential license keys and potential disruption of licensing operations, with no known privilege escalation beyond the authenticated scope.