EUVD-2026-77451
GHSA-654h-qhhm-rvq6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects mandatory authentication; A:L added because license deletion disrupts premium module availability, which the provided vector omits.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys, inject attacker-controlled values, or delete stored licenses entirely.
AnalysisAI
Missing authorization on three License API admin endpoints in laradashboard through 1.2.2 allows any authenticated low-privileged user to read, overwrite, or delete premium module license keys without admin rights. The affected endpoints - GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove - perform no role or permission check beyond basic authentication, exposing confidential license material and enabling destructive writes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with any account in the laradashboard application - including the lowest privilege level. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 with PR:L reflects the authentication requirement that bounds real-world risk: an attacker must first possess a valid low-privileged account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a version of laradashboard beyond 1.2.2 once a patched release is confirmed - no specific fixed version number is independently verified in the available data; consult the GitHub Security Advisory GHSA-j4m5-rrc4-5qv6 for the current status. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit systems running laradashboard 1.2.2 or earlier for potential compromise (publicly available exploit code exists); review logs for unauthorized access to /api/admin/licenses/show, /api/admin/licenses/store, and /api/admin/licenses/remove; implement network-level segmentation to restrict these endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today