PT-2026-104596

CVE-2026-105130

Published

2026-10-03

Updated

2026-10-04

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LaraDashboard versions 1.4.0 through 1.4.7

Description A race condition exists in the RegisterController::register function. This allows unauthenticated attackers to bypass the daily registration limit per IP address by sending multiple concurrent registration requests. Because these requests can all pass the RegistrationGuardService::hasExceededIpLimit check before the recordRegistration function executes, attackers can create accounts in bulk, effectively defeating anti-automation controls.

Recommendations Update LaraDashboard to version 1.4.8.

Exploitability

Exploit

Fix

Impacts

Researchers

Evil0Rd

Vendors

Affected products

Weakness enumeration

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

Related identifiers