CVE-2026-86437

Katalog CVE

CVSS 7.2 · High EPSS 0,71%

Kerentanan Incorrect Authorization. Skor CVSS 3.1 7.2 (High) menurut vulncheck.com.

Deskripsi (NVD)

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which execute as the web server user with access to environment secrets and database credentials.

Rincian

Terbit di NVD

7 September 2026

Terakhir diubah

8 September 2026

Status NVD

Deferred

CVSS 3.1

7.2 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/laradashboard/laradashboard
• https://github.com/laradashboard/laradashboard/blob/v1.3.1/app/Http/Requests/CoreUpgrade/UploadRequest.php#L15...
• https://github.com/laradashboard/laradashboard/blob/v1.3.1/app/Policies/SettingPolicy.php#L47-L50
• https://github.com/laradashboard/laradashboard/blob/v1.3.1/app/Services/CoreUpgradeService.php#L543-L577
• https://github.com/laradashboard/laradashboard/commit/738cc1a219ce459323ef1d09c3789075f1b8d2f2
• https://github.com/laradashboard/laradashboard/releases/tag/v1.3.2
• https://github.com/laradashboard/laradashboard/security/advisories/GHSA-xv98-x5h7-4g7v
• https://www.vulncheck.com/advisories/lara-dashboard-before-1.3.2-incorrect-authorization-in-core-upgrade-archi...