NVD HIGH: CVE-2026-105126 — LaraDashboard before 1.4.8 contains an improper privilege management vulnerabili...

Sunday, October 4, 2026 at 12:16 AM UTC·Source: NIST NVD

Updated: Sunday, October 4, 2026 at 03:00 AM UTC

Executive Summary

LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.login_as permissions to take over accounts and reach core upgrade and module installation functions for code execution.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-105126

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 4, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Weekly Update 524: Live From Copenhagen

I'm in Denmark! Well, just, I'm now at Copenhagen airport ready to begin the long trek home, with the final event at GOTO now done and going just perfectly. This week, there are two ShinyHunters arrests in the news: Pepijn in the Netherlands and then Saif

32m agoTroy Hunt

MEDIUMVulnerability

User Agent Strings Curiosities, (Sun, Oct 4th)

Sometimes I have to smile, or my interest is triggered, when I review new User Agent Strings in the honeypot logs.

4h agoSANS ISC

MEDIUMVulnerability

ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members

A suspected member of the ShinyHunters digital extortion group, who goes by the online alias "Rey," has been allegedly detained by authorities in Jordan, Reuters reported, citing three people familiar with the matter. Rey, whose real name is Saif ‌al-Din Khader, is said to have been brought into custody on September 29, 2026, cooperating with the U.S. Federal Bureau of Investigation (FBI) and

5h agoThe Hacker News