PT-2026-135466

CVE-2026-120450

·

Published

2026-11-02

·

Updated

2026-11-02

Description by

CVSS 3.1
4.3
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-863: Incorrect Authorization
Related identifiers
CVE-2026-120450
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com