CVE-2026-86438

HighCVSS 7.2/10Last modified Sep 10, 2026

Description

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote code execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 7, 2026
Last modified: Sep 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-864398.8knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and del CVE-2026-86449.1IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.CVE-2026-864405.4Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is stor CVE-2026-864414.3Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Severa CVE-2026-864436.9Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local CVE-2026-864447.1The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, a CVE-2026-864455.3The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowin CVE-2026-864463.7The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing una CVE-2026-864475.3The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing una CVE-2026-864483.7The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously gen CVE-2026-864495.3The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in o CVE-2026-864507.5Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal a