What’s Vulnerable › Vulnerabilities

CVE-2026-105127: LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-04 · updated 2026-10-05
• Weakness: CWE-770

Description

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making validation fail open for all public forms, and probe domain resolution.

Affected products

• laradashboard: from 1.4.2 before 1.4.8 — fixed in 1.4.8

How to fix

Upgrade to a fixed version: laradashboard 1.4.8. Check the vendor advisory for mitigations.

References

• https://github.com/laradashboard/laradashboard
• https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Requests/Auth/ForgotPasswordRequest.php#L22-L27
• https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Requests/Auth/ResetPasswordRequest.php#L23-L30
• https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Services/EmailDomainCheckService.php#L128
• https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Services/EmailVerificationService.php#L95-L114
• https://github.com/laradashboard/laradashboard/commit/8babc803066a74c628fa012928fb1e6591411eba
• https://github.com/laradashboard/laradashboard/pull/339
• https://github.com/laradashboard/laradashboard/releases/tag/v1.4.8
• https://github.com/laradashboard/laradashboard/security/advisories/GHSA-5hq2-r2f3-9vp9
• https://github.com/laradashboard/laradashboard/security/advisories/GHSA-v36p-8578-8gch
• https://www.vulncheck.com/advisories/laradashboard-1.4.2-before-1.4.8-resource-exhaustion-via-password-recovery-endpoints
• https://github.com/laradashboard/laradashboard/security/advisories/GHSA-v36p-8578-8gch

Get alerted when CVE-2026-105127 or the next vulnerability affects your stack