Race Condition Vulnerability in LaraDashboard by LaraTeam
CVE-2026-105130

6.3MEDIUM

Key Information:

Vendor

Laradashboard

Status
Laradashboard
Vendor
CVE Published:
3 October 2026

What is CVE-2026-105130?

LaraDashboard versions prior to 1.4.8 exhibit a race condition vulnerability in the registration process. Unauthenticated attackers can leverage this flaw in RegisterController::register, allowing them to bypass the per-IP daily registration limit. By sending multiple concurrent registration requests from a single IP address, attackers can exploit the vulnerability and create numerous accounts, effectively circumventing anti-automation controls intended to restrict rogue registrations.

Affected Version(s)

laradashboard 1.4.0 < 1.4.8

laradashboard 1.4.8

References

https://github.com/laradashboard/laradashboard/security/a...
vendor-advisory
https://github.com/laradashboard/laradashboard/blob/v1.4....
technical-description
https://github.com/laradashboard/laradashboard/blob/v1.4....
technical-description

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

EVIL0RD
.