Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing… (CVE-2026-86437)
Description
Lara Dashboard versions prior to 1.3.2 have an authorization flaw where the POST /admin/settings/core-upgrades/upload endpoint requires only the settings.edit permission. This allows non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Malicious archives can contain modified application files with embedded system commands that execute with the web server user's privileges, potentially exposing environment secrets and database credentials.
CVSS v3.1
Score 7.2high
Affected software
pkg:github/laradashboard/laradashboardRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86437 describes an authorization vulnerability in Lara Dashboard before version 1.3.2. The POST /admin/settings/core-upgrades/upload endpoint improperly authorizes users with only the settings.edit permission, enabling them to upload and extract arbitrary zip archives into the live application source code. This can be exploited by attackers to upload malicious archives containing modified files such as routes/web.php with embedded system commands. These commands execute with the web server user's privileges, which may include access to sensitive environment variables and database credentials. The vulnerability is classified under CWE-863 (Incorrect Authorization).
Potential Impact
Successful exploitation allows an attacker with settings.edit permission but without Superadmin privileges to execute arbitrary code on the server as the web server user. This can lead to full compromise of the application environment, including disclosure of environment secrets and database credentials, and potentially complete control over the application.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the settings.edit permission to fully trusted administrators only and monitor for unauthorized use of the /admin/settings/core-upgrades/upload endpoint.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-849q-7g6r-c83p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-86437"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a9f910facd9273b49ff2a8f
Added to database: 09/08/2026, 04:37:35 UTC
Last enriched: 09/08/2026, 05:07:16 UTC
Last updated: 10/22/2026, 01:15:26 UTC
Views: 37
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.