CVE-2026-120450

MEDIUM 4.3

LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.

CWE	CWE-863
Vendor	laradashboard
Product	laradashboard
Published	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for laradashboard laradashboard

Be the first to know when new medium vulnerabilities affecting laradashboard laradashboard are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

LaraDashboard / LaraDashboard

1.4.0 < 1.4.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv github.com: https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed github.com: https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9 github.com: https://github.com/laradashboard/laradashboard/blob/v1.4.8/app/Mcp/Tools/SendEmailTool.php#L24-L40 vulncheck.com: https://www.vulncheck.com/advisories/laradashboard-1.4.0-before-1.4.9-improper-authorization-via-mcp-send-email-tool

Credits

EVIL0RD