---
id: CVE-2026-105126
title: >-
  LaraDashboard before 1.4.8 contains an improper privilege management
  vulnerability that allows authenticated Admin users to escalate to Superadmin
  by editing or renaming roles
summary: >-
  LaraDashboard before 1.4.8 contains an improper privilege management
  vulnerability that allows authenticated Admin users to escalate to Superadmin
  by editing or renaming roles. Attackers with role.edit can rename their role
  to Superadmin…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-269
vendor: laradashboard
product: laradashboard
affected:
  - laradashboard < 1.4.8
published: '2026-10-04'
updated: '2026-10-04'
sourceUpdated: '2026-10-04T00:16:36.340'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105126'
references:
  - url: 'https://github.com/laradashboard/laradashboard'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Backend/RoleController.php#L144
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Backend/RoleController.php#L180
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Requests/CoreUpgrade/UploadRequest.php#L23
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/RolePolicy.php#L39-L50
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/laradashboard/laradashboard/commit/286f150e4d0c924ec1ce7eb256b2326e871e9517
    label: disclosure@vulncheck.com
  - url: 'https://github.com/laradashboard/laradashboard/pull/344'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/laradashboard/laradashboard/releases/tag/v1.4.8'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/laradashboard/laradashboard/security/advisories/GHSA-555v-6rfr-r969
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/laradashboard-before-1.4.8-privilege-escalation-via-superadmin-role-tampering
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-04T00:50:56.107Z'
epss: 0.00493
epssPercentile: 0.40139
---

## Overview

LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.login_as permissions to take over accounts and reach core upgrade and module installation functions for code execution.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.