Security Advisory

CVE-2026-86438

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-07 22:01:49

Last updated 2026-09-07 22:01:49

Assigner VulnCheck

CVSS score 8.6

State PUBLISHED

Description

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote code execution.

← Browse all CVEs View on cve.org ↗