{"schema":"threatline.record/2","record":{"id":"CVE-2026-105130","aliases":["GHSA-gw6g-9wx9-3fpj"],"summary":"LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per-IP Registration Limit","details":"LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allows unauthenticated attackers to bypass the per-IP daily registration limit. Attackers can send many concurrent registration requests from one IP so all pass RegistrationGuardService::hasExceededIpLimit before recordRegistration runs, creating accounts in bulk and defeating anti-automation controls.","categories":["Unclassified"],"product":"laradashboard","vendor":"laradashboard","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105130","source_modified_at":"2026-10-05T16:14:41.623Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"laradashboard","vendor":"laradashboard","versions":[{"version":"1.4.0","status":"affected","versionType":"semver","lessThan":"1.4.8"},{"version":"1.4.8","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105130","source_modified_at":"2026-10-05T16:14:41.623Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"laradashboard","ecosystem":null},"version":"1.4.8","basis":"first unaffected version stated in the CVE record"}],"cvss":6.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00223,"percentile":0.1226,"score_date":"2026-10-23"},"published_at":"2026-10-03T23:40:02.301Z","modified_at":"2026-10-05T16:14:41.623Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-105130","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-05T16:14:41.623Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105130","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/laradashboard/laradashboard/security/advisories/GHSA-gw6g-9wx9-3fpj","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Auth/RegisterController.php#L175-L188","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Services/Auth/RegistrationGuardService.php#L77-L105","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/laradashboard/laradashboard/pull/343","tags":["patch","issue-tracking"]},{"source":"CVE List","url":"https://github.com/laradashboard/laradashboard/commit/1bc7b7e2d32dd0bbee8f39a7ed8a3316ae657d50","tags":["patch"]},{"source":"CVE List","url":"https://github.com/laradashboard/laradashboard/releases/tag/v1.4.8","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/laradashboard/laradashboard","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/laradashboard-1.4.0-before-1.4.8-race-condition-bypasses-per-ip-registration-limit","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-05T16:11:27.294260Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T16:14:41.623Z","content_hash":"9aaa92ce13aa99a8e3b3797a0192ebbcf76742da96f5f8a7cc827910881717c7"}}