CVE-2026-120450

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120450", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-02T12:42:19.894Z", "datePublished": "2026-11-02T14:29:08.850Z", "dateUpdated": "2026-11-05T21:42:52.454Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T14:29:08.850Z"}, "datePublic": "2026-11-01T00:00:00.000Z", "title": "LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool", "descriptions": [{"lang": "en", "value": "LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "affected": [{"vendor": "LaraDashboard", "product": "LaraDashboard", "packageURL": "pkg:github/laradashboard/laradashboard", "defaultStatus": "unaffected", "versions": [{"version": "1.4.0", "lessThan": "1.4.9", "status": "affected", "versionType": "semver"}], "repo": "https://github.com/laradashboard/laradashboard"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:laradashboard:lara_dashboard:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.4.0", "versionEndExcluding": "1.4.9"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-gjfv-h634-pxpv)"}, {"url": "https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed", "tags": ["patch"]}, {"url": "https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9", "tags": ["release-notes"], "name": "LaraDashboard v1.4.9 Release Notes"}, {"url": "https://github.com/laradashboard/laradashboard/blob/v1.4.8/app/Mcp/Tools/SendEmailTool.php#L24-L40", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/laradashboard-1.4.0-before-1.4.9-improper-authorization-via-mcp-send-email-tool"}], "credits": [{"lang": "en", "value": "EVIL0RD", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T21:42:22.562803Z", "id": "CVE-2026-120450", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:42:52.454Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120450", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:42:22.562803Z"}}}], "references": [{"url": "https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:42:45.878Z"}}], "cna": {"title": "LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool", "credits": [{"lang": "en", "type": "finder", "value": "EVIL0RD"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/laradashboard/laradashboard", "vendor": "LaraDashboard", "product": "LaraDashboard", "versions": [{"status": "affected", "version": "1.4.0", "lessThan": "1.4.9", "versionType": "semver"}], "packageURL": "pkg:github/laradashboard/laradashboard", "defaultStatus": "unaffected"}], "datePublic": "2026-11-01T00:00:00.000Z", "references": [{"url": "https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv", "name": "GitHub Security Advisory (GHSA-gjfv-h634-pxpv)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed", "tags": ["patch"]}, {"url": "https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9", "name": "LaraDashboard v1.4.9 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/laradashboard/laradashboard/blob/v1.4.8/app/Mcp/Tools/SendEmailTool.php#L24-L40", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/laradashboard-1.4.0-before-1.4.9-improper-authorization-via-mcp-send-email-tool", "name": "VulnCheck Advisory: LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:laradashboard:lara_dashboard:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.4.9", "versionStartIncluding": "1.4.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T14:29:08.850Z"}}}, "cveMetadata": {"cveId": "CVE-2026-120450", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:42:52.454Z", "dateReserved": "2026-11-02T12:42:19.894Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-02T14:29:08.850Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/laradashboard/laradashboard", "product": "LaraDashboard", "repo": "https://github.com/laradashboard/laradashboard", "vendor": "LaraDashboard", "versions": [{"lessThan": "1.4.9", "status": "affected", "version": "1.4.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer."}], "id": "CVE-2026-120450", "lastModified": "2026-11-05T22:17:54.627", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120450", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:42:22.562803Z", "version": "2.0.3"}}]}, "published": "2026-11-02T15:17:28.140", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/laradashboard/laradashboard/blob/v1.4.8/app/Mcp/Tools/SendEmailTool.php#L24-L40"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/laradashboard-1.4.0-before-1.4.9-improper-authorization-via-mcp-send-email-tool"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "laradashboard/laradashboard: LaraDashboard: Unauthorized email dispatch via improper authorization in MCP send-email tool", "id": "2567670", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567670"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-267", "details": ["LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.", "A flaw was found in LaraDashboard. An improper authorization vulnerability allows an authenticated attacker with read-only permissions to dispatch arbitrary emails through the Model Context Protocol (MCP) send-email tool. By acquiring an MCP token and invoking the tool, an attacker can send unauthorized messages with custom recipients, subjects, and content directly from the application's mail service."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-120450", "public_date": "2026-11-02T14:29:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120450\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120450\nhttps://github.com/laradashboard/laradashboard/blob/v1.4.8/app/Mcp/Tools/SendEmailTool.php#L24-L40\nhttps://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed\nhttps://github.com/laradashboard/laradashboard/releases/tag/v1.4.9\nhttps://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv\nhttps://www.vulncheck.com/advisories/laradashboard-1.4.0-before-1.4.9-improper-authorization-via-mcp-send-email-tool"], "statement": "This vulnerability is rated as Moderate impact because exploitation requires existing authenticated access with specific read permissions, limiting the blast radius to unauthorized message transmission rather than underlying host compromise. LaraDashboard is not packaged or distributed within Red Hat products, and there is no direct impact on supported Red Hat environments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.4.0,1.4.9)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "LaraDashboard", "source": "cna", "vendor": "LaraDashboard"}, "product": "lara_dashboard", "vendor": "laradashboard"}], "created": "2026-11-02T15:30:14.815403+00:00", "updated": "2026-11-06T15:30:06.476969+00:00", "vendors": ["laradashboard", "laradashboard$PRODUCT$lara_dashboard"]}