# CVE-2026-90933: laradashboard missing authorization in License API

Source: https://junglewise.ai/threats/cve-2026-90933-laradashboard-missing-authorization-in-license-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90933 · Severity: high · CVSS 7.1 · Published 2026-09-14

laradashboard is a Laravel-based dashboard/admin panel framework. A missing authorization vulnerability in its license management API endpoints allows any authenticated user—even those with minimal privileges—to read, overwrite, and delete premium module license keys. An attacker with a low-privilege account (e.g., a regular employee account) can extract license information, corrupt licenses with fake values, or disable premium features entirely, disrupting operations and potentially enabling unauthorized software use.

Technologies: [LaraDashboard](https://junglewise.ai/threats/technologies/laradashboard). Vendors: [LaraDashboard](https://junglewise.ai/threats/vendors/laradashboard).

## Quick answers

**Is CVE-2026-90933 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90933 being exploited in the wild.

**How severe is CVE-2026-90933?** High severity, with a CVSS score of 7.1, published 14 September 2026.

**Which products and versions are affected?** LaraDashboard through 1.2.2.

**Is there a fix for CVE-2026-90933?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90933 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-90933?** Check whether you run LaraDashboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control flaw (CWE-862) in the Local License API controller (LocalLicenseController.php). The three endpoints GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove are registered under an authenticated middleware group but lack role-based authorization checks. All three Form Requests hardcode authorize(): bool { return true }, bypassing permission gates that are correctly enforced on equivalent web routes. An authenticated attacker without admin permissions can invoke these endpoints to disclose stored license keys, inject attacker-controlled license values, or delete licenses. The vulnerability requires an authenticated session but no additional user interaction. No patches are currently available; upgrading above version 1.2.2 or applying custom permission middleware is required.

## Affected products

- laradashboard laradashboard through 1.2.2

## Timeline

- 2026-08-30: disclosed
- 2026-09-14: advisory

## References

- [https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j4m5-rrc4-5qv6](https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j4m5-rrc4-5qv6)
- [https://www.vulncheck.com/advisories/laradashboard-through-1.2.2-missing-authorization-via-license-api](https://www.vulncheck.com/advisories/laradashboard-through-1.2.2-missing-authorization-via-license-api)

## Related threats

- [LaraDashboard stored cross-site scripting in page builder](https://junglewise.ai/threats/cve-2026-120488-laradashboard-before-1-4-9-contains-a-stored-cross-site)
- [LaraDashboard incorrect authorization in core upgrades](https://junglewise.ai/threats/cve-2026-120487-laradashboard-before-1-4-5-contains-an-incorrect-authorization)
- [LaraDashboard improper authorization in email send tool](https://junglewise.ai/threats/cve-2026-120450-laradashboard-1-4-0-before-1-4-9-contains-an-improper)
- [LaraDashboard authorization bypass in settings API](https://junglewise.ai/threats/cve-2026-105129-laradashboard-before-1-4-8-contains-an-incorrect-authorization)
- [LaraDashboard open redirect in email template controller](https://junglewise.ai/threats/cve-2026-105128-laradashboard-before-1-4-8-contains-an-open-redirect)