Description

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-07T22:17:22.163Z",
  "pubdate": "2026-09-07T22:17:22.163Z",
  "executiveSummary": "Lara Dashboard versions prior to 1.3.2 are susceptible to an improper authorization vulnerability within the MarketplaceModuleBrowser component.\nThe vulnerability permits non-privileged administrators to execute the installModule Livewire action, a function intended exclusively for Superadmin users.\nBy bypassing access control checks, an authenticated attacker with administrative credentials can initiate the download and automatic execution of arbitrary PHP modules from the marketplace.\nThis vulnerability facilitates Remote Code Execution (RCE) on the underlying server, as the application fails to validate the integrity or source of the modules during the installation lifecycle.\nThe risk is severe, as the lack of unsigned HTTP request verification allows attackers to introduce malicious code directly into the production environment.\nSuccessful exploitation requires valid, lower-privileged administrator access to the dashboard, but does not necessitate elevated Superadmin permissions, posing a significant threat to internal platform integrity.",
  "technicalDetails": "The vulnerability resides within the MarketplaceModuleBrowser component of Lara Dashboard, specifically concerning the handling of the installModule Livewire action.\nThe root cause is a failure to enforce sufficient authorization checks before executing the installation logic. The application assumes that any administrative user interacting with the dashboard is authorized to manage marketplace modules, neglecting the implementation of a mandatory Superadmin permission gate for the installModule function.\nThe attack flow begins with an attacker possessing standard administrative credentials—lacking Superadmin status—authenticating to the Lara Dashboard. The attacker identifies the MarketplaceModuleBrowser Livewire component and triggers the installModule action via a crafted request.\nBecause the backend component fails to verify the session user's authorization level against the required Superadmin role, the application proceeds to process the installation request.\nThe mechanism is further compromised by the lack of cryptographic signature validation for the modules being fetched. The system performs unsigned HTTP requests to retrieve modules from the marketplace. An attacker can manipulate the destination or supply a malicious package path that the server will automatically download and integrate into the application context.\nOnce the malicious module is downloaded, the framework proceeds to auto-activate the code. Since these modules are standard PHP files intended to integrate with the system, the execution of the injected code occurs within the same security context as the web server process.\nThis leads to complete Remote Code Execution, allowing the attacker to interact with the filesystem, access sensitive configuration files, establish persistence, or pivot within the host network.\nThis vulnerability remains present in all Lara Dashboard versions prior to 1.3.2. Authentication is required to reach the dashboard, but the lack of granular privilege enforcement allows for the escalation of impact from limited administrative access to full system compromise."
}