CVE-2026-87821

Name of the Vulnerable Software and Affected Versions Lara Dashboard versions prior to 1.3.2

Description An authenticated user can perform a server-side request forgery (SSRF) via the 'POST /api/admin/builder/markdown/fetch' endpoint. This occurs because the application fails to validate hosts or restrict redirects, allowing attackers to fetch arbitrary URLs and read the response body. This can be used to access internal HTTP services and cloud metadata, such as IAM credentials.

Recommendations Update Lara Dashboard to version 1.3.2 or later. As a temporary mitigation, restrict access to the 'POST /api/admin/builder/markdown/fetch' endpoint.