CVE-2026-120450— LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool

Quick assessment

Affected

LaraDashboard LaraDashboard

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LaraDashboard 1.4.0 至 1.4.9（不含 1.4.9）版本中存在一个授权不当漏洞。该漏洞允许拥有只读权限的已认证用户，通过 MCP（Model Context Protocol）的工具发送任意邮件。攻击者可生成 MCP 令牌，并调用功能，指定任意收件人、主题及原始 HTML 正文，从而利用该站点的邮件系统发送网络钓鱼或垃圾邮件。

CVSS 4.3 · Medium Updated Nov 02, 2026

Possible ATT&CK Techniques 2 AI

T1566.002 · Spearphishing Link T1055.001 · Dynamic-link Library Injection

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool

Source: CVE Program / CVE List V5

Vulnerability Description

LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
LaraDashboard	LaraDashboard	1.4.0 ~ 1.4.9	-

II. Public POCs for CVE-2026-120450

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120450

请登录查看更多情报信息。

Other References for CVE-2026-120450 (5)

https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed patch
https://github.com/laradashboard/laradashboard/blob/v1.4.8/app/Mcp/Tools/SendEmailTool.php#L24-L40 technical-description
https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9 release-notes
https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv vendor-advisory
https://www.vulncheck.com/advisories/laradashboard-1.4.0-before-1.4.9-improper-authorization-via-mcp-send-email-tool third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120450

Same Patch Batch · LaraDashboard · 2026-11-02 · 3 CVEs total

CVE-2026-120487	7.2 HIGH	LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades
CVE-2026-120488	5.4 MEDIUM	LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content

IV. Related Vulnerabilities

Same product: LaraDashboard

Same vendor: LaraDashboard

Same weakness: CWE-863