CVE-2026-105127: LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints
LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making validation fail open for all public forms, and probe domain resolution.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
LaraDashboard versions 1.4.2 through versions before 1.4.8 are affected. Exposure exists where the public forgot-password or reset-password endpoints are reachable, because these requests are unauthenticated.
What does an attacker need to do to trigger the issue?
No account, privileges, or user interaction are required. An attacker can submit arbitrary email addresses to the password-recovery endpoints, causing DNS lookups and AbstractAPI verification calls.
What is the practical impact of exhausting the verification quota?
Quota exhaustion can cause advanced email validation to fail open across all public forms. Attackers can also use requests to probe domain resolution.