CVE-2026-105128 in LaraDashboard
Summary
by MITRE • 10/04/2026
LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url parameter to EmailTemplateController builder and builderEdit. Attackers can send crafted builder links to logged-in users with email template permissions so saving a template navigates them to attacker-controlled phishing sites.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/04/2026
The security flaw identified in LaraDashboard versions prior to 1.4.8 constitutes an open redirect vulnerability, specifically classified under CWE-601 as URL Redirection to Untrusted Site. This weakness arises from insufficient validation of user-supplied input within the application's request handling logic. The core technical issue resides in the EmailTemplateController module, where two specific endpoints, builder and builderEdit, accept a parameter named redirect_url without performing adequate checks against an allowlist or verifying that the target destination is part of the same trusted domain. By design, web applications often use redirect parameters to return users to their previous location after completing an action; however, when this mechanism relies on untrusted input, it becomes a vector for malicious redirection attacks.
The operational impact of this vulnerability allows remote attackers to manipulate the navigation flow of authenticated users who possess email template permissions. An attacker can construct a specially crafted URL containing a malicious redirect_url parameter pointing to a phishing site or other harmful destination controlled by the adversary. This link is then distributed to victims, typically through social engineering tactics such as deceptive emails or messages that appear legitimate and relevant to their role within the organization. When an authenticated user clicks this link and interacts with the application interface, specifically when saving a template, the system processes the unvalidated parameter and redirects the browser to the attacker-controlled site rather than returning the user to the expected internal page.
This vulnerability is particularly dangerous because it leverages the trust users place in the legitimate domain of LaraDashboard. Since the redirect originates from a trusted source, security filters and anti-phishing tools may fail to flag the subsequent malicious URL as suspicious. This technique aligns with MITRE ATT&CK tactic T1566.002, which describes Spearphishing Link attacks where attackers send links designed to trick users into visiting malicious websites. The ability to redirect logged-in users facilitates credential harvesting, malware distribution, or further exploitation of the target environment by establishing a foothold through deceptive navigation rather than direct technical intrusion.
To mitigate this risk, developers must implement strict validation for all redirect parameters. Best practices dictate that applications should either restrict redirects to a predefined list of safe domains or ensure that any provided URL points exclusively to paths within the same origin as the application itself. Input sanitization alone is insufficient; explicit domain verification logic must be integrated into the EmailTemplateController's builder and builderEdit methods before processing the redirect_url parameter. Additionally, organizations should enforce multi-factor authentication for administrative accounts and monitor user activity logs for unusual redirection patterns that may indicate exploitation attempts in progress.