CVE-2026-86438: Lara Dashboard RCE Vulnerability

CVE-2026-86438 Overview

CVE-2026-86438 is a missing authorization vulnerability [CWE-862] in Lara Dashboard versions prior to 1.3.2. The MarketplaceModuleBrowser Livewire component fails to authorize the installModule action. Any authenticated administrator, not only Superadmin accounts, can trigger module installation. The installer downloads and auto-activates arbitrary PHP modules from the marketplace over unsigned HTTP requests, resulting in remote code execution on the host.

Critical Impact
Non-Superadmin administrators can install attacker-controlled PHP modules and execute arbitrary code within the Lara Dashboard application context.

Affected Products

Lara Dashboard versions prior to 1.3.2
Vulnerable component: app/Livewire/Marketplace/MarketplaceModuleBrowser.php
Related policy gap: app/Policies/ModulePolicy.php

Discovery Timeline

2026-09-07 - CVE-2026-86438 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86438

Vulnerability Analysis

Lara Dashboard exposes marketplace functionality through a Livewire component named MarketplaceModuleBrowser. The installModule action inside this component omits an authorization check against ModulePolicy. As a result, the framework enforces only the requirement that the caller is an authenticated administrator, not that the caller holds the Superadmin role intended for module management.

When invoked, the action retrieves a module descriptor from the marketplace catalog, downloads the associated PHP archive, unpacks it into the modules directory, and activates it. Because activation loads and executes PHP files shipped in the archive, any attacker able to reach installModule can achieve arbitrary code execution within the web application process.

The download step performs unsigned HTTP requests. There is no signature verification, integrity check, or provenance validation on the module payload. A network attacker positioned between the dashboard and the marketplace could also substitute payloads, expanding the exploitation surface beyond authenticated abuse.

Root Cause

The root cause is a missing authorization gate on a privileged Livewire action. ModulePolicy defines the intended Superadmin restriction, but MarketplaceModuleBrowser::installModule never calls authorize() or an equivalent gate check before performing the install workflow. The absence of transport-layer signing on marketplace fetches compounds the impact.

Attack Vector

An attacker requires valid administrator credentials on the target Lara Dashboard instance. The attacker then invokes the installModule Livewire action over the network, supplying a marketplace module identifier. The server downloads the referenced PHP module, writes it to disk, and activates it, executing attacker-supplied code with the privileges of the PHP runtime.

php

// Security patch: hardening of related builder endpoints in the same commit
namespace App\Http\Controllers\Api\Builder;

use App\Http\Controllers\Controller;
use App\Http\Requests\Builder\MarkdownConvertRequest;
use App\Http\Requests\Builder\MarkdownConvertUrlRequest;
use App\Http\Requests\Builder\MarkdownFetchRequest;
use App\Services\Builder\MarkdownFetchService;
use Illuminate\Http\JsonResponse;

class MarkdownController extends Controller
{
    // Request classes now enforce validation and authorization
}

// PostController.php - explicit authorize() call added before upload
public function uploadImage(Request $request, string $postType = 'post'): JsonResponse
{
    $this->authorize('uploadBuilderMedia', Post::class);

    $request->validate([
        'image' => 'required|image|mimes:jpeg,png,jpg,gif,webp|max:5120',
    ]);
}

Source: GitHub commit 738cc1a. The patch introduces explicit authorize() calls and dedicated form request classes across marketplace, upload, upgrade, and markdown fetch paths.

Detection Methods for CVE-2026-86438

Indicators of Compromise

Livewire requests targeting the MarketplaceModuleBrowser component with an installModule method invocation from non-Superadmin sessions.
New directories or PHP files appearing under the Lara Dashboard Modules/ path outside of scheduled maintenance windows.
Outbound HTTP requests from the web server to marketplace endpoints or unexpected third-party hosts that return ZIP or PHP archives.
Newly registered service providers or route bindings in application logs referencing modules not previously deployed.

Detection Strategies

Correlate Laravel authentication logs with Livewire message payloads to flag installModule calls performed by administrators without the Superadmin role.
Monitor filesystem writes to module directories from the PHP-FPM or web server process and alert on writes not preceded by a deployment pipeline event.
Inspect egress traffic for module downloads over plain HTTP and compare fetched artifact hashes against an approved allowlist.

Monitoring Recommendations

Enable Laravel policy denial logging and audit any ModulePolicy decisions to establish a baseline of legitimate module installation activity.
Forward web server, application, and filesystem events to a centralized analytics tier so that install actions can be replayed and reviewed across timeframes.

How to Mitigate CVE-2026-86438

Immediate Actions Required

Upgrade Lara Dashboard to version 1.3.2 or later, which adds the missing authorization check on the installModule action.
Audit all administrator accounts and revoke roles that do not require module management access until the upgrade is complete.
Review installed modules and remove any that were not deployed by a Superadmin through an approved change process.

Patch Information

The fix is delivered in Lara Dashboard release v1.3.2 and implemented in commit 738cc1a. Additional context is available in the GitHub Security Advisory GHSA-4x9p-vg5m-vr6p and the VulnCheck advisory.

Workarounds

If patching is not immediately possible, restrict access to the marketplace and module management routes at the reverse proxy layer to trusted IP ranges.
Temporarily disable the MarketplaceModuleBrowser Livewire component or remove its route registration until upgrade is applied.
Set the modules directory to read-only for the PHP runtime user to prevent write-based installation until an authorization fix is deployed.

bash

# Upgrade Lara Dashboard to the patched release
composer require laradashboard/laradashboard:^1.3.2
php artisan config:clear
php artisan cache:clear
php artisan route:clear

# Interim: restrict access to marketplace routes at the web tier
# nginx example
location ~ ^/(admin/marketplace|livewire/message/marketplace) {
    allow 10.0.0.0/24;   # admin management network
    deny  all;
}