Description

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys, inject attacker-controlled values, or delete stored licenses entirely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-14T13:19:31.680Z",
  "pubdate": "2026-09-14T13:19:31.680Z",
  "executiveSummary": "Laradashboard versions through 1.2.2 are susceptible to a critical broken access control vulnerability within the Local License API endpoints.\nThe vulnerability stems from improper authorization checks, allowing any authenticated user to interact with administrative API functions without the required privileges.\nAn attacker can exploit this flaw to perform unauthorized CRUD (Create, Read, Update, Delete) operations on sensitive premium module license keys.\nThe impact includes the full disclosure of confidential license data, the modification of license values with attacker-controlled input, and the deletion of stored license configurations.\nThis vulnerability poses a significant risk to system integrity and service availability, as it effectively bypasses administrative security boundaries.\nExploitation requires the attacker to possess a low-privileged authenticated account within the application to invoke the unprotected API endpoints.\nSuccessful exploitation results in the unauthorized manipulation of licensing mechanisms, potentially leading to unauthorized access to premium features or service disruption.",
  "technicalDetails": "The vulnerability is localized within the Local License API management component of Laradashboard. The root cause is the absence of server-side authorization checks on several sensitive administrative endpoints, specifically /api/admin/licenses/show, /api/admin/licenses/store, and /api/admin/licenses/remove.\nWhile the endpoints are routed under the '/admin/' namespace, the underlying Laravel controller logic fails to enforce mandatory permission checks to ensure that the authenticated user possesses administrative roles or sufficient privileges before processing requests.\nAn attacker with a low-privileged account can interact with these endpoints by sending direct HTTP requests to the server. By issuing a GET request to /api/admin/licenses/show, the attacker can retrieve confidential license key data that should be restricted to super-administrators.\nThe vulnerability further allows for data integrity compromise through the /api/admin/licenses/store endpoint. By submitting a POST request containing custom or malicious payloads, an authenticated user can overwrite existing legitimate license keys. This facilitates the injection of attacker-controlled values, which may disrupt service authentication logic or reconfigure application behavior depending on how these license keys are utilized by the backend modules.\nFurthermore, the /api/admin/licenses/remove endpoint allows for the unauthorized deletion of license keys. An attacker can trigger a POST request to this endpoint to purge stored licenses, resulting in a denial-of-service condition for premium modules that rely on the presence of valid license keys.\nThe attack flow proceeds as follows: 1) The attacker authenticates as a low-privileged user. 2) The attacker crafts an HTTP request targeting one of the exposed license management API endpoints. 3) The backend receives the request and, due to the missing middleware or authorization gate validation, processes the request as if it originated from a privileged administrator. 4) The API performs the requested action (reading, writing, or deleting) on the license data repository.\nAffected versions include all iterations of Laradashboard up to and including 1.2.2. The lack of network-level segmentation or IP-based restrictions means this vulnerability is accessible from any network path that allows authenticated access to the application API."
}