CVE-2026-105130
Deferred Deferred - Pending Action

Race Condition in LaraDashboard Registration Mechanism

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: VulnCheck

Description
LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allows unauthenticated attackers to bypass the per-IP daily registration limit. Attackers can send many concurrent registration requests from one IP so all pass RegistrationGuardService::hasExceededIpLimit before recordRegistration runs, creating accounts in bulk and defeating anti-automation controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-04
Last Modified
2026-10-04
Generated
2026-10-04
AI Q&A
2026-10-04
EPSS Evaluated
N/A
NVD
CVE-2026-105130
EUVD
EUVD-2026-92052

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
laradashboard laradashboard to 1.4.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in LaraDashboard versions 1.4.0 to 1.4.7. It allows unauthenticated attackers to bypass the per-IP daily registration limit by sending many concurrent registration requests. The system checks the limit before creating accounts but increments the counter afterward, letting all requests pass the check before any counter update occurs.

Detection Guidance

To detect this vulnerability, monitor for unusually high registration attempts from a single IP address within a short timeframe. Check Laravel logs for multiple registration requests failing or succeeding in quick succession. Use commands like 'grep' to search for repeated registration attempts in access logs: grep -i "register" /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -nr. Also inspect Redis cache entries for registration counters if used by RegistrationGuardService.

Impact Analysis

Attackers can create multiple accounts from a single IP address in bulk, defeating anti-automation controls like rate limiting. This could lead to spam, abuse of registration systems, or resource exhaustion on the server.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized mass account creation. GDPR requires data protection measures against automated processing, while HIPAA mandates access controls for protected health information. The race condition allows bypassing registration limits, which could lead to unauthorized system access or data exposure if exploited.

Mitigation Strategies

Immediately upgrade to LaraDashboard version 1.4.8 or later to apply the atomic registration slot reservation fix. If upgrading is not possible, implement a cache lock mechanism in RegistrationGuardService to ensure thread-safe counter increments. Temporarily increase rate limiting or disable registration entirely until patched. Monitor registration logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105130. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart