CVE-2026-120450

Published: Nov 2, 2026Modified: Nov 5, 2026Deferred

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (6)

https://github.com/laradashboard/laradashboard/blob/v1.4.8/app/Mcp/Tools/SendEmailTool.php#L24-L40

Source: disclosure@vulncheck.com

https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed

Source: disclosure@vulncheck.com

https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9

Source: disclosure@vulncheck.com

https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/laradashboard-1.4.0-before-1.4.9-improper-authorization-via-mcp-send-email-tool

Source: disclosure@vulncheck.com

https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.