CVE-2026-105129: LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/{optionname} to retrieve plaintext AI provider API keys, mail credentials, passwords and tokens.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated LaraDashboard user granted the settings.view permission can exploit it. No higher-privileged settings modification permission is required.
What access does an attacker need to retrieve secrets?
The attacker needs a valid authenticated account with settings.view permission and network access to the LaraDashboard API. They can request GET /api/settings or GET /api/settings/{option_name} without user interaction.
What information may be exposed?
The affected API can return stored secrets in plaintext, including AI provider API keys, mail credentials, passwords, and tokens.
How can I check whether my deployment is affected?
Deployments running LaraDashboard before 1.4.8 are affected. Review whether accounts with only settings.view permission can call the settings API and receive secret-valued settings in responses.