Read the docs
TI-2026-83842 Aliases CVE-2026-120450GHSA-g452-mgph-pcc8

LaraDashboard Improper Authorization in MCP send-email Tool

Priority MEDIUM 57CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

LaraDashboard from 1.4.0 before 1.4.9 contains an improper authorization flaw (CWE-863) in its MCP send-email tool. An authenticated user with only read-only email_template.view permission can send arbitrary emails to any recipient with any subject and raw HTML body, enabling phishing or spam from the site's mailer.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00238 14th percentileScored 2026-11-07
Fix Fixed LaraDashboard (LaraDashboard): 1.4.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
laradashboardLaraDashboard1.4.0 to before 1.4.91.4.9Patch availableCNA
  • LaraDashboard Vendorlaradashboard Affected 1.4.0 to before 1.4.9 Fixed in 1.4.9 Patch available CNA

Remediation

Upgrade LaraDashboard to version 1.4.9 or later, which is the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA LaraDashboard (LaraDashboard) Fixed in 1.4.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    LaraDashboard 1.4.9

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-83855 Stored cross-site scripting in LaraDashboard LaraBuilder blocksPriority LOW 23
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120450
  2. 2026-11-02 Alias added: GHSA-g452-mgph-pcc8
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: LOW → MEDIUM
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Advisory 1

Other 2

  • TI-2026-83854 LaraDashboard lets non-Superadmin admins access core upgrade actions CVSS 4.0HIGH 8.6
  • TI-2026-61796 LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE CVSS 4.0HIGH 8.6
  • TI-2026-59145 Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload CVSS 4.0HIGH 8.6
  • TI-2026-67502 LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints CVSS 4.0MEDIUM 6.9
  • TI-2026-67504 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API CVSS 4.0HIGH 7.1
  • TI-2026-61797 laradashboard through 1.2.2 Missing Authorization via License API CVSS 4.0HIGH 7.1
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences