CVE-2026-90933: Laradashboard Auth Bypass Vulnerability

CVE-2026-90933 Overview

CVE-2026-90933 is a missing authorization vulnerability [CWE-862] affecting laradashboard through version 1.2.2. The flaw resides in the Local License API endpoints, which fail to enforce administrator-level authorization checks. Any authenticated user, including low-privileged accounts, can read, overwrite, or delete premium module license keys. Affected endpoints include GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove. Exploitation results in disclosure of confidential license keys, injection of attacker-controlled values, and destruction of stored licenses.

Critical Impact
Authenticated low-privilege users can exfiltrate, tamper with, or delete premium license keys through unprotected administrative API endpoints, compromising confidentiality and integrity of licensing data.

Affected Products

laradashboard versions up to and including 1.2.2
Local License API endpoints under /api/admin/licenses/
Premium module licensing components dependent on stored keys

Discovery Timeline

2026-09-14 - CVE-2026-90933 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90933

Vulnerability Analysis

The vulnerability stems from missing authorization enforcement on administrative license management routes in laradashboard. Although the endpoints reside under the /api/admin/ prefix, the controllers do not verify that the requesting user holds administrator privileges. Any authenticated session token is accepted as sufficient to invoke these operations.

Three endpoints are impacted. GET /api/admin/licenses/show returns stored license keys in cleartext to the caller. POST /api/admin/licenses/store writes attacker-supplied values into the license store. POST /api/admin/licenses/remove deletes existing license records. Combined, these primitives allow a low-privileged authenticated attacker to disclose sensitive licensing material, substitute forged keys, or disable premium functionality entirely.

Root Cause

The root cause is the absence of a role-based authorization middleware or policy gate on the license controller actions. The application authenticates the caller but never authorizes the action against the caller's role. This is a classic instance of Broken Access Control mapped to [CWE-862] Missing Authorization.

Attack Vector

Exploitation requires network access to the application and a valid low-privileged user account. No user interaction is required beyond issuing HTTP requests. An attacker registers or compromises any standard account, authenticates against the application, and issues requests to the vulnerable admin license endpoints. Because attack complexity is low and no additional privileges are required, exploitation is straightforward once account access is obtained.

No verified proof-of-concept code has been published. Refer to the GitHub Security Advisory GHSA-j4m5-rrc4-5qv6 and the VulnCheck Advisory on Laradashboard for authoritative technical details.

Detection Methods for CVE-2026-90933

Indicators of Compromise

Requests to /api/admin/licenses/show, /api/admin/licenses/store, or /api/admin/licenses/remove originating from non-administrator user sessions.
Unexpected modifications, additions, or deletions in the license storage table or configuration files backing the license module.
Authentication logs showing standard user accounts issuing requests to admin-prefixed API routes.

Detection Strategies

Correlate authenticated session role attributes against HTTP request paths, alerting when non-admin roles access /api/admin/* routes.
Deploy application-layer logging that captures the request path, method, user identifier, and role for every license API call.
Baseline legitimate administrator traffic to the license endpoints and flag deviations by source account or IP.

Monitoring Recommendations

Enable audit logging on the license controller and forward events to a centralized SIEM for retention and correlation.
Monitor for repeated POST /api/admin/licenses/store calls, which may indicate license key tampering attempts.
Track deletion events on the license table and alert on any removal not originating from an administrator workflow.

How to Mitigate CVE-2026-90933

Immediate Actions Required

Upgrade laradashboard to a version above 1.2.2 once a patched release is published by the maintainers.
Rotate all premium module license keys that were stored on affected instances, treating existing keys as potentially disclosed.
Audit application logs for prior access to /api/admin/licenses/show, /api/admin/licenses/store, and /api/admin/licenses/remove by non-administrator accounts.

Patch Information

Refer to the GitHub Security Advisory GHSA-j4m5-rrc4-5qv6 for the authoritative fix and release information. Apply the vendor-supplied update as soon as it becomes available and validate that authorization middleware is enforced on all /api/admin/* routes.

Workarounds

Restrict access to /api/admin/licenses/* routes at the reverse proxy or web server layer using IP allowlists limited to administrator workstations.
Add a temporary authorization check or middleware to the license controller that verifies the authenticated user holds the administrator role before executing the handler.
Reduce the population of authenticated accounts on affected instances until the patch is applied, minimizing the number of potential attackers.

bash

# Example NGINX restriction limiting admin license endpoints to trusted IPs
location ~ ^/api/admin/licenses/ {
    allow 10.0.0.0/24;   # administrator subnet
    deny all;
    proxy_pass http://laradashboard_upstream;
}