CyberRota Analysis
AI-GeneratedThe Local License API endpoints in laradashboard versions up to 1.2.2 are vulnerable due to a missing authorization check, allowing authenticated users with low privileges to access, modify, or delete premium module license keys. This could lead to unauthorized disclosure of sensitive license information and potential disruption of service. Organizations using laradashboard should prioritize patching this vulnerability to protect their license management processes and prevent exploitation by malicious actors.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys, inject attacker-controlled values, or delete stored licenses entirely.