---
id: CVE-2026-120450
title: >-
  LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email
  Tool
summary: >-
  LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization
  vulnerability that allows authenticated users with read-only
  email_template.view permission to send arbitrary emails via the MCP send-email
  tool. Attackers can mint an M…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: LaraDashboard
product: LaraDashboard
affected:
  - LaraDashboard >= 1.4.0 < 1.4.9
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:42:22.562803Z'
exploitAvailable: true
published: '2026-11-02'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:42:52.454Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120450'
references:
  - url: >-
      https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gjfv-h634-pxpv
    label: GitHub Security Advisory (GHSA-gjfv-h634-pxpv)
  - url: >-
      https://github.com/laradashboard/laradashboard/commit/5955d725683b1e63af8c38a149211d6151465aed
  - url: 'https://github.com/laradashboard/laradashboard/releases/tag/v1.4.9'
    label: LaraDashboard v1.4.9 Release Notes
  - url: >-
      https://github.com/laradashboard/laradashboard/blob/v1.4.8/app/Mcp/Tools/SendEmailTool.php#L24-L40
  - url: >-
      https://www.vulncheck.com/advisories/laradashboard-1.4.0-before-1.4.9-improper-authorization-via-mcp-send-email-tool
    label: >-
      VulnCheck Advisory: LaraDashboard 1.4.0 before 1.4.9 Improper
      Authorization via MCP send-email Tool
tags:
  - cve.org
  - exploit-available
epss: 0.00238
epssPercentile: 0.14929
ingestedAt: '2026-11-05T19:30:42.655Z'
---

## Overview

LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.

## Affected

- `LaraDashboard >= 1.4.0 < 1.4.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.