LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool
- Exploited
- No known exploitation
- Fix
- Fixed in 1.4.9
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affected version is v1.4.2 according to the advisory (the CVE describes 1.4.0 before 1.4.9). The attacker needs a token or user holding the email_template.view read permission, which is the only check on the send-email tool. A token created before email_template.view was granted keeps the new ability, because tokens hold a snapshot of abilities taken at mint time.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 13/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 1.4.9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.
What to do
Check whether your setup matches what the bug needs.
Affected version is v1.4.2 according to the advisory (the CVE describes 1.4.0 before 1.4.9). The attacker needs a token or user holding the email_template.view read permission, which is the only check on the send-email tool. A token created before email_template.view was granted keeps the new ability, because tokens hold a snapshot of abilities taken at mint time.Upgrade to a fixed version: 1.4.9.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- LaraDashboard LaraDashboard
From 1.4.0 · fixed in 1.4.9
Evidence 5
- Advisory
- Patch
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120450
What does this mean?
The send-email tool in the MCP interface is gated only by the email_template.view read permission, so a token or user holding that permission can send arbitrary outbound email with any recipient, subject and raw HTML body from the application's mailer. The flaw is an improper authorization check, and the impact described is phishing, social engineering and spam relay.Source: github.com
Am I affected, and how do I check?
The CVE describes versions 1.4.0 before 1.4.9, while the advisory names v1.4.2 as affected, and the two sources do not fully agree on the range. Check the installed LaraDashboard version in the application, and check whether any MCP tokens were created before email_template.view was granted, since those tokens keep the send-email ability taken at mint time.Source: github.com
What should I do about it?
Upgrade to LaraDashboard 1.4.9 or later, which is the fixed version given in the CVE. The checked facts do not include a vendor fix notice or a workaround, so confirm the upgrade against the vendor's advisory.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data