CVE-2026-105129GHSA-xgmw-7ppx-v7hq
LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API
laradashboard laradashboard
CVSS
7.1HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 6 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.4.8laradashboardCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/{option_name} to retrieve plaintext AI provider API keys, mail credentials, passwords and tokens.
Text from CVE List
Affected versions 2
- laradashboardaffected: all versions before 1.4.8CVE List
- laradashboardunaffected: 1.4.8CVE List
References 9
- github.com/laradashboard/laradashboard/pull/340Fixvia CVE List
- github.com/laradashboard/laradashboard/commit/532a10efd2cc1338ef3f59236f195df859b2dbe3Fixvia CVE List
- github.com/laradashboard/laradashboard/releases/tag/v1.4.8Fixvia CVE List
- github.com/laradashboard/laradashboard/security/advisories/GHSA-xgmw-7ppx-v7hqAdvisoryvia CVE List
- vulncheck.com/advisories/laradashboard-before-1.4.8-incorrect-authorization-exposes-secrets-via-settings-apiAdvisoryvia CVE List
- github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Api/SettingController.php#L23-L50Referencevia CVE List
- github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Resources/SettingResource.php#L17-L26Referencevia CVE List
- github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/SettingPolicy.php#L15-L34Referencevia CVE List
- github.com/laradashboard/laradashboardReferencevia CVE List