CVE-2026-120450 Details
Description
LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.
An improper authorization vulnerability has been identified in LaraDashboard versions 1.4.0 prior to 1.4.9. This vulnerability allows authenticated users with read-only 'email_template.view' permission to send arbitrary emails using the MCP 'send-email' tool. Exploitation involves minting an MCP token and using it to send emails with any recipient, subject, and raw HTML body, potentially delivering phishing or spam through the site's mailing system.
The 'SendEmailTool' should be gated behind the 'email_template.*' permissions and an 'admin_only' or new 'mcp.email.send' permission, rather than the current read permission. Additionally, token abilities should be derived per call, with tokens rotated when user roles or permissions change.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/laradashboard/laradashboard/blob/v1.4.8/app/Mcp/Tools/SendEmailTool.php#L24-L40 | [email protected] | Source CodeVendor |
| https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed | [email protected] | Source CodeVendor |
| https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9 | [email protected] | Release NotesVendor |
| https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/laradashboard-1.4.0-before-1.4.9-improper-authorization-via-mcp-send-email-tool | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LaraDashboard | >= 1.4.0, < 1.4.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |