CVE-2026-105128

Name of the Vulnerable Software and Affected Versions LaraDashboard versions prior to 1.4.8

Description An open redirect issue exists where remote attackers can redirect users to external phishing sites. This occurs when an unvalidated redirect url parameter is supplied to the builder and builderEdit endpoints of the EmailTemplateController. Logged-in users with email template permissions may be affected if they interact with crafted builder links and save a template.

Recommendations Update to version 1.4.8 or later. As a temporary mitigation, restrict access to the builder and builderEdit endpoints of the EmailTemplateController or avoid using the redirect url parameter.