Description
LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| LaraDashboard | LaraDashboard | 1.4.0 – < 1.4.9 | 1.4.9 |
References
- GitHub Security Advisory (GHSA-gjfv-h634-pxpv) vendor-advisory
- https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed patch
- LaraDashboard v1.4.9 Release Notes release-notes
- https://github.com/laradashboard/laradashboard/blob/v1.4.8/app/Mcp/Tools/SendEmailTool.php#L24-L40 technical-description
- VulnCheck Advisory: LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool third-party-advisory