Incorrect Authorization in LaraDashboard Exposes Sensitive Data

CVE-2026-105129

What is CVE-2026-105129?

LaraDashboard versions prior to 1.4.8 are affected by an incorrect authorization vulnerability that permits authenticated users with only the 'settings.view' permission to gain access to sensitive data via the settings API. This flaw can be exploited by attackers to retrieve plaintext API keys from AI providers, mail credentials, passwords, and other critical tokens by querying specific GET endpoints like /api/settings or /api/settings/{option_name}. Such exposure can lead to a severe compromise of user privacy and application integrity.

References