CVE-2026-86437

Lara Dashboard before 1.3.2 fails to properly enforce authorization on the POST /admin/settings/core-upgrades/upload endpoint, which requires only the settings.edit permission instead of Superadmin-level access (CWE-863, CVSS 4.0: 8.6 High). Any authenticated non-Superadmin administrator holding that permission can upload an arbitrary zip archive that is extracted directly over the live application source code. By crafting an archive containing modified application files, for example routes/web.php with embedded system commands, the attacker gains code execution as the web server user, with access to environment secrets and database credentials. Installations running any version of Lara Dashboard earlier than 1.3.2 are affected. No public proof-of-concept or in-the-wild exploitation is known; EPSS currently assigns a 0.4% probability of exploitation within 30 days (32nd percentile), and the flaw is not in CISA KEV.

What to do: Upgrade to Lara Dashboard 1.3.2 or later, which restricts the core-upgrade upload endpoint to Superadmin-level authorization. Until patched, limit the settings.edit permission to Superadmins only and monitor uploads to /admin/settings/core-upgrades/upload. Deployments where non-Superadmin administrators held that permission should inspect core application files such as routes/web.php for unexpected modifications and rotate environment secrets and database credentials.