Executive brief
laradashboard is a Laravel-based dashboard/admin panel framework. A missing authorization vulnerability in its license management API endpoints allows any authenticated user—even those with minimal privileges—to read, overwrite, and delete premium module license keys. An attacker with a low-privilege account (e.g., a regular employee account) can extract license information, corrupt licenses with fake values, or disable premium features entirely, disrupting operations and potentially enabling unauthorized software use.
Technical details
The vulnerability is a broken access control flaw (CWE-862) in the Local License API controller (LocalLicenseController.php). The three endpoints GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove are registered under an authenticated middleware group but lack role-based authorization checks. All three Form Requests hardcode authorize(): bool { return true }, bypassing permission gates that are correctly enforced on equivalent web routes. An authenticated attacker without admin permissions can invoke these endpoints to disclose stored license keys, inject attacker-controlled license values, or delete licenses. The vulnerability requires an authenticated session but no additional user interaction. No patches are currently available; upgrading above version 1.2.2 or applying custom permission middleware is required.
Affected products
- laradashboard laradashboard through 1.2.2
Timeline
- 2026-08-30: disclosed
- 2026-09-14: advisory