Resource Exhaustion Vulnerability in LaraDashboard by LaraDashboard
CVE-2026-105127

6.9MEDIUM

Key Information:

Vendor

Laradashboard

Status
Laradashboard
Vendor
CVE Published:
3 October 2026

What is CVE-2026-105127?

LaraDashboard versions prior to 1.4.8 are susceptible to a resource exhaustion vulnerability due to inadequate email validation in unauthenticated password recovery requests. This flaw allows attackers to input arbitrary email addresses, which triggers unnecessary DNS lookups and incurs costs from AbstractAPI for email verification calls. Consequently, the verification quota can be depleted, leading to failures in validating email addresses across public forms, which may expose sensitive information through domain probing.

Affected Version(s)

laradashboard 1.4.2 < 1.4.8

laradashboard 1.4.8

References

https://github.com/laradashboard/laradashboard/security/a...
vendor-advisory
https://github.com/laradashboard/laradashboard/security/a...
vendor-advisory
https://github.com/laradashboard/laradashboard/blob/v1.4....
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

EVIL0RD
.