CVE-2026-120450

Name of the Vulnerable Software and Affected Versions LaraDashboard versions 1.4.0 through 1.4.8

Description An improper authorization issue allows authenticated users who possess only the read-only email template.view permission to send arbitrary emails. By minting an MCP token, an attacker can utilize the MCP send-email tool to specify any recipient, subject, and raw HTML body, enabling the delivery of phishing or spam messages through the site's mailer.

Recommendations Update LaraDashboard to version 1.4.9 or later.