CVE ID :CVE-2026-120487 Published : 2. November 2026 14:29 | 34 Minuten ago Description :LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-120487 - LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades

VERWANDTEARTIKEL

CVE-2026-105769 - kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

CVE-2026-88811 - Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy

CVE-2026-94290 - Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller

CVE-2026-77876 - Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory

CVE-2026-77877 - Control Web Panel (CWP) < 1.30 Unauthenticated Loopback API Root Access

CVE-2026-77878 - Control Web Panel (CWP) < 1.30 OS Command Injection via restoredatabase API