LaraDashboard: Privilege escalation to Superadmin via role tampering

Summary

LaraDashboard before version 1.4.8 allows an authenticated administrator with role-edit rights to escalate privileges to the Superadmin role. By renaming their own role to Superadmin or granting the user.login_as permission, an attacker can take over other accounts. From there, the attacker can reach core upgrade and module installation functions, which may lead to code execution. The attack requires a valid admin account with role.edit permission.

Affected

• LaraDashboard versions before 1.4.8 (affected range 0 to less than 1.4.8 per the CNA record)

Fixed in

• Version 1.4.8 or later

Workaround

• No vendor workaround documented.
• Restrict admin login to VPN or an IP allowlist.
• Limit role.edit and user.login_as permissions to the fewest accounts possible.

Exploitation

• No known exploitation in the wild according to the current sources.
• No public proof-of-concept found.
• CISA SSVC: exploitation none, not automatable, total technical impact.

Our recommendation

• Identify all LaraDashboard instances and their versions, for example via composer lock files.
• Upgrade to version 1.4.8 or later.
• Review existing roles, recent role and permission changes, and admin logins for signs of tampering.
• Keep the admin panel off the public internet where possible and enforce multi-factor authentication.
• Also upgrade to 1.4.8 to cover other LaraDashboard vulnerabilities.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-555v-6rfr-r969 github.com
• LaraDashboard release v1.4.8 github.com
• Fix commit 286f150e4d0c924ec1ce7eb256b2326e871e9517 github.com
• Pull request #344 github.com
• VulnCheck advisory www.vulncheck.com
• RoleController.php at v1.4.2 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:22.