CVE-2026-120450 in LaraDashboard
Summary
by MITRE • 11/02/2026
LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in LaraDashboard versions prior to 1.4.9 represents a critical failure in access control mechanisms, specifically classified under CWE-269 Improper Privilege Management. This flaw allows authenticated users who possess only read-only permissions for viewing email templates to escalate their privileges and execute actions that should be restricted to administrators or higher-level roles. The core of the issue lies in the improper authorization logic governing the Model Context Protocol MCP send-email tool, which fails to validate whether the requesting user has sufficient rights to initiate outbound communication through the application's mailer service.
From a technical perspective, an attacker can exploit this vulnerability by first minting an MCP token using their existing low-privileged credentials. Once the token is generated, it grants access to various tools exposed by the system, including the send-email functionality. The authorization check for this specific tool appears to be either missing or incorrectly implemented, allowing any authenticated user with the email_template.view permission to invoke the endpoint without triggering an unauthorized access error. This bypasses standard role-based access control policies that are typically designed to prevent non-administrative users from sending emails on behalf of the application.
The operational impact of this vulnerability is severe due to its potential for abuse in social engineering attacks. An attacker can craft arbitrary email messages with any recipient address, subject line, and raw HTML body content. This capability enables the delivery of sophisticated phishing campaigns that appear to originate directly from the trusted domain associated with LaraDashboard. By leveraging the application's legitimate mailer infrastructure, attackers can increase the likelihood of their emails bypassing spam filters and gaining trust from recipients who recognize the sender as a known entity. Additionally, this vulnerability facilitates mass spam distribution, which can lead to IP address blacklisting for the organization hosting the dashboard, resulting in significant reputational damage and operational disruptions for legitimate email communications.
This behavior aligns with several tactics within the MITRE ATT&CK framework, particularly T1078 Valid Accounts, as it involves using valid credentials to gain unauthorized access to resources, and T1534 Internal Spearphishing if used against internal users or T1566 Phishing for external targets. The ability to send arbitrary HTML content also introduces risks associated with Cross-Site Scripting if the email client renders the content in a way that executes malicious scripts upon opening, although this depends heavily on the recipient's mail client configuration and security settings.
To mitigate this vulnerability, organizations running LaraDashboard must immediately upgrade to version 1.4.9 or later where these authorization checks have been corrected. Until an update is applied, administrators should consider restricting access to the MCP tools for users who do not require them, effectively implementing a principle of least privilege at the network or application gateway level if possible. It is also advisable to audit existing user permissions and remove unnecessary email_template.view rights from accounts that do not have a legitimate business need to view templates. Monitoring outbound email logs for unusual patterns can help detect ongoing exploitation attempts, although this serves as a reactive measure rather than a preventive one.