Security Advisory
CVE-2026-86438
CVSS 7.2
HIGH
Vulnerability Description
Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote code execution.
Published Date
2026-09-07T22:17:22.163
Data Feed
NIST National Vulnerability Database