CVE-2026-90933

LaraDashboard through version 1.2.2 contains a missing authorization flaw (CWE-862) in its Local License API, meaning any authenticated user, including low-privileged accounts, can reach admin-only license endpoints. The flaw is triggered by sending ordinary authenticated requests to GET /api/admin/licenses/show, POST /api/admin/licenses/store, or POST /api/admin/licenses/remove, which lack proper role-based access checks. A successful attacker can disclose confidential premium module license keys, overwrite them with attacker-controlled values, or delete them entirely to disrupt licensed functionality. All deployments running version 1.2.2 or earlier are affected. No public proof-of-concept exists and the CVE is not in CISA's KEV catalog, so exploitation is not known to be occurring.

What to do: Upgrade to a release newer than 1.2.2 as soon as the maintainer publishes a fix; no patched version is identified in the advisory. In the interim, restrict access to the /api/admin/licenses/* routes via role-based middleware or WAF/reverse-proxy rules so only administrators can reach them, and rotate any premium module license keys that may have been exposed. Review application logs for requests to these endpoints from non-admin accounts to detect prior abuse.