Threats tagged 'ghsa-2q9q-2jvp-h2qm'

LaraDashboard versions prior to 1.4.5 have an authorization vulnerability in the SettingPolicy::manageCoreUpgrades() function. This flaw allows administrators without Superadmin privileges but with settings.edit permission to perform core upgrade operations reserved for Superadmins. Exploitable actions include backup, download, restore, and upgrade of the site, potentially exposing database dumps with password hashes and enabling unauthorized site modifications.