CVE-2026-105129 in LaraDashboard
Summary
by MITRE • 10/04/2026
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/{option_name} to retrieve plaintext AI provider API keys, mail credentials, passwords and tokens.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/04/2026
The identified vulnerability in LaraDashboard versions prior to 1.4.8 represents a critical failure in access control mechanisms, specifically categorized under CWE-269 Improper Privilege Management. This flaw allows authenticated users who possess only the minimal settings.view permission to bypass intended restrictions and extract sensitive configuration data from the application's backend API endpoints. The core technical issue lies in the server-side logic governing the GET /api/settings endpoint and its variant for specific option names, which fails to validate whether the requesting user has sufficient privileges to access secret values such as AI provider API keys, email credentials, passwords, and authentication tokens. Instead of masking these sensitive fields or restricting their exposure based on a higher-level administrative role, the application returns them in plaintext within the JSON response payload for any authenticated session holding the view permission.
From an operational perspective, this vulnerability poses severe risks to the confidentiality and integrity of the entire system environment. By exploiting this flaw, an attacker with low-privileged access can harvest credentials that are often reused across multiple services or used as master keys for external integrations. The exposure of AI provider API keys could lead to unauthorized usage of paid services, resulting in financial loss and potential abuse for malicious activities such as generating harmful content. Similarly, the disclosure of mail credentials may allow attackers to send phishing emails using the organization's domain, damaging reputation and facilitating further social engineering attacks. Access to stored passwords and tokens can serve as a stepping stone for lateral movement within the network if these credentials are shared across internal systems or cloud resources.
This type of vulnerability is frequently associated with ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate user accounts to maintain persistence and access sensitive data without triggering typical intrusion detection alerts due to the use of valid authentication tokens. The lack of proper authorization checks on API endpoints that handle configuration data highlights a common oversight in web application development where role-based access control is not strictly enforced at the resource level for every property within an object. This aligns with CWE-862 Missing Authorization, as the application does not ensure that authorized users have explicit permission to perform specific actions or view specific data elements associated with those actions.
To mitigate this vulnerability, immediate updates to LaraDashboard version 1.4.8 or later are required, as these versions presumably contain patches for this authorization logic. In environments where patching is delayed, administrators should implement compensating controls such as web application firewall rules that restrict access to the settings API endpoints based on user roles rather than just authentication status. Additionally, it is crucial to audit all other API endpoints for similar privilege escalation flaws and ensure that sensitive configuration data is never returned in plaintext responses unless explicitly required by high-privilege administrative functions. Implementing strict input validation and output encoding practices, along with regular security code reviews focusing on access control lists, will help prevent recurrence of such authorization bypasses in future development cycles.