Executive brief
Lara Dashboard is a Laravel-based CMS platform that manages users, roles, permissions, and modules. A flaw in the MarketplaceModuleBrowser component fails to properly authorize the module installation action, allowing non-administrator users to install arbitrary PHP modules from an insecure marketplace, leading to remote code execution on the server.
Technical details
The MarketplaceModuleBrowser Livewire component in Lara Dashboard before version 1.3.2 lacks proper authorization checks on the installModule action. The vulnerability allows authenticated but non-Superadmin users to trigger module installation. Attackers can exploit this to download and automatically activate arbitrary PHP modules from the marketplace over unsigned HTTP connections. Since modules execute with application privileges, successful exploitation grants remote code execution. The fix was introduced in version 1.3.2.
Affected products
- Lara Dashboard Lara Dashboard before 1.3.2
Timeline
- 2026-09-07: disclosed