CVE-2026-86438

CVE-2026-86438 is a missing-authorization flaw (CWE-862) in Lara Dashboard versions before 1.3.2: the MarketplaceModuleBrowser Livewire action installModule does not verify that the caller holds Superadmin rights. Any authenticated non-Superadmin administrator can invoke the action to download and automatically activate PHP modules fetched from the marketplace over unsigned HTTP requests, with no integrity validation on the delivered code. An attacker who holds or hijacks a lower-tier administrator account can therefore execute arbitrary PHP on the host running the dashboard, effectively escalating nominal admin access into full server compromise. Only deployments running an affected version are exposed, particularly those that grant administrator (non-Superadmin) accounts to less-trusted users; the CVSS 4.0 score of 8.6 High reflects the network-exploitable, admin-authenticated attack path with high impact on the vulnerable system. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates roughly a 0.6% probability of exploitation within 30 days.

What to do: Upgrade Lara Dashboard to version 1.3.2 or later, which adds the missing authorization check on the installModule action. As an interim mitigation, restrict dashboard administrator roles to trusted Superadmin users or remove non-Superadmin admin accounts, and review recently installed or auto-activated marketplace modules plus the server's module directories for unexpected PHP files. Restricting the host's outbound HTTP and monitoring install logs can also limit and detect MITM- or abuse-driven module installs.