🔐 CVE Alert

CVE-2026-105128

MEDIUM 5.4

LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_url

CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th

LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url parameter to EmailTemplateController builder and builderEdit. Attackers can send crafted builder links to logged-in users with email template permissions so saving a template navigates them to attacker-controlled phishing sites.

CWE CWE-601
Vendor laradashboard
Product laradashboard
Published Oct 3, 2026
Stay Ahead of the Next One

Get instant alerts for laradashboard laradashboard

Be the first to know when new medium vulnerabilities affecting laradashboard laradashboard are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Affected Versions

laradashboard / laradashboard
0 < 1.4.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j2vp-w788-8fcf github.com: https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Backend/EmailTemplateController.php#L142 github.com: https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Backend/EmailTemplateController.php#L159 github.com: https://github.com/laradashboard/laradashboard/blob/v1.4.2/resources/js/lara-builder/core/LaraBuilder.jsx#L762 github.com: https://github.com/laradashboard/laradashboard/pull/341 github.com: https://github.com/laradashboard/laradashboard/commit/c08da68236267afc0c0073598f66fadbc1b53b66 github.com: https://github.com/laradashboard/laradashboard/releases/tag/v1.4.8 github.com: https://github.com/laradashboard/laradashboard vulncheck.com: https://www.vulncheck.com/advisories/laradashboard-before-1.4.8-open-redirect-via-email-template-builder-redirect-url

Credits

EVIL0RD