Server-Side Request Forgery in Lara Dashboard from Laradashboard

CVE-2026-87821

What is CVE-2026-87821?

Lara Dashboard versions 0.9.2 through 1.3.1 are susceptible to a server-side request forgery vulnerability. This issue allows authenticated users to exploit the vulnerable POST /api/admin/builder/markdown/fetch endpoint, enabling them to fetch arbitrary URLs and read the response body. Attackers can potentially extract sensitive information such as internal HTTP services and cloud metadata, including IAM credentials, by supplying malicious URLs. The absence of host validation and redirect restrictions exacerbates the threat, making it crucial for users to update to versions post-1.3.1, where the SafeUrlValidator was introduced to mitigate this vulnerability.

References