Improper Authorization in LaraDashboard Allows Email Spoofing

Executive Summary

CVE-2026-120450 is an improper authorization flaw in LaraDashboard versions 1.4.0 to 1.4.8. It allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and send phishing or spam emails from the application's mailer by specifying any recipient, subject, and raw HTML body.

Useful 0 Not Useful 0

Detection Guidance

Check if your LaraDashboard version is below 1.4.9. Inspect MCP token permissions for users with email_template.view access. Review email logs for unexpected outbound messages or phishing attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables attackers to send phishing emails or spam from your application, potentially tricking recipients into revealing sensitive information or installing malware. It could damage your organization's reputation and lead to account compromises if users fall for the phishing attempts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exposure or phishing attacks, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding patient information. Organizations may face compliance penalties if user data is compromised through such attacks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to LaraDashboard 1.4.9 or later. Revoke and regenerate all MCP tokens. Restrict email_template.view permissions to only necessary users. Monitor email logs for suspicious activity.

Useful 0 Not Useful 0