Improper Authorization in LaraDashboard Allows Email Manipulation
CVE-2026-120450

5.3MEDIUM

Key Information:

Vendor

Laradashboard

Status
Laradashboard
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120450?

LaraDashboard versions 1.4.0 through 1.4.8 have a vulnerability that permits authenticated users holding read-only 'email_template.view' permission to exploit the MCP send-email tool. This allows them to send arbitrary emails, potentially leading to phishing attempts or spam. Attackers can create an MCP token and exploit the send-email feature, specifying any recipient, subject, and body, thus utilizing the site's mailer for malicious purposes.

Affected Version(s)

LaraDashboard 1.4.0 < 1.4.9

References

https://github.com/laradashboard/laradashboard/security/a...
vendor-advisory
https://github.com/laradashboard/laradashboard/commit/595...
patch
https://github.com/laradashboard/laradashboard/releases/t...
release-notes

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

EVIL0RD
.