EUVD-2026-72534
GHSA-9wqq-j933-4w98
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain non-Superadmin admin credentials
-
DeliveryAccess MarketplaceModuleBrowser Livewire endpoint
-
ExploitInvoke installModule bypassing Superadmin policy gate
-
ExecutionDashboard fetches arbitrary PHP module over unsigned HTTP
-
PersistModule auto-activated on server
-
ImpactArbitrary PHP code executed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session holding the non-Superadmin administrator role on a Lara Dashboard instance prior to v1.3.2. The marketplace module browser feature must be accessible (default configuration). Unauthenticated users and standard non-admin users cannot exploit this vulnerability. The secondary supply-chain vector - substituting a malicious module payload - additionally requires network-position capability to intercept unsigned outbound HTTP between the dashboard server and the marketplace endpoint. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) correctly captures that network reach is trivial but exploitation is gated behind an authenticated administrator account, substantially limiting the realistic attack surface to insider threats or compromised admin credentials. The full C:H/I:H/A:H impact is justified because arbitrary PHP module activation is functionally equivalent to remote code execution. No EPSS data was provided in the input; the vulnerability is not in CISA KEV, and no POC repository has been identified, so exploitation remains theoretical at time of analysis. Risk is most acute in multi-admin deployments where the administrator role is delegated to personnel who should not hold code-execution capability - even a mid-sized IT operations team running multiple dashboard instances should treat this as urgent patching work if non-Superadmin admin accounts are actively in use. The secondary unsigned-download vector elevates risk for deployments on networks where HTTP interception is feasible. |
| Exploit ScenarioDerived | An attacker with non-Superadmin administrator credentials logs into a Lara Dashboard instance running v1.3.1 or earlier and directly invokes the installModule Livewire action against the marketplace browser, bypassing the Superadmin-only policy gate. The dashboard fetches and auto-activates a PHP module over unsigned HTTP; if the attacker or a network-adjacent adversary can redirect that download, a PHP webshell is installed and activated with the web server's OS privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
Missing authorization on the MarketplaceModuleBrowser installModule Livewire action in Lara Dashboard before 1.3.2 permits any authenticated non-Superadmin administrator to install arbitrary PHP modules from the marketplace. Because module downloads occur over unsigned HTTP without integrity verification, an attacker holding an administrator credential can pull and auto-activate attacker-chosen PHP code, achieving remote code execution on the underlying server. The fix is available in v1.3.2; no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Upgrade Lara Dashboard to version 1.3.2 or later; the release includes commit 738cc1a219ce459323ef1d09c3789075f1b8d2f2, which adds the missing authorization gate to the installModule Livewire action. The fix and affected versions are detailed in GHSA-4x9p-vg5m-vr6p and the VulnCheck advisory at https://www.vulncheck.com/advisories/lara-dashboard-before-1.3.2-missing-authorization-in-marketplace-module-install-action. If immediate upgrade is not feasible, eliminate all non-Superadmin administrator accounts so that only Superadmin-tier users exist - this removes the exploitable privilege tier entirely, though it may restrict operational workflows. Supplementarily, blocking outbound HTTP from the dashboard host to marketplace endpoints at the network perimeter prevents unsigned module downloads, but will also disable legitimate marketplace browsing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Lara Dashboard is an open-source Laravel/PHP admin panel framework that uses Livewire for reactive UI components. The vulnerable component is the installModule action in app/Livewire/Marketplace/MarketplaceModuleBrowser.php (lines 76-120 in v1.3.1). The framework's ModulePolicy at app/Policies/ModulePolicy.php#L32-L38 defines module installation as a Superadmin-only capability, but the Livewire action omits the policy gate invocation before proceeding - a textbook CWE-862 (Missing Authorization) defect. Modules are fetched over plain HTTP with no cryptographic signature validation, compounding the risk: a network-position attacker could substitute a malicious payload during transit. The patch at commit 738cc1a219ce459323ef1d09c3789075f1b8d2f2 inserts the missing authorization check into the action handler and is shipped in v1.3.2.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Requires authenticated administrator account (PR:H) over network (AV:N); no attack complexity constraints (AC:L); arbitrary PHP module activation yields full RCE (C:H/I:H/A:H).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote code execution.
Articles & Coverage 1
Technical POC Analysis
Missing authorization (CWE-862).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Lara Dashboard before v1.3.2 allows authorized administrators to install arbitrary PHP modules that achieve remote code execution on web servers. Organizations using this platform risk complete infrastructure compromise through either credential compromise or insider misuse, as the attack requires only standard administrator access.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB