CVE-2026-105130: LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per-IP Registration Limit
LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allows unauthenticated attackers to bypass the per-IP daily registration limit. Attackers can send many concurrent registration requests from one IP so all pass RegistrationGuardService::hasExceededIpLimit before recordRegistration runs, creating accounts in bulk and defeating anti-automation controls.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
LaraDashboard versions from 1.4.0 up to, but not including, 1.4.8 are affected. The issue concerns the registration flow and its per-IP daily registration limit.
What does an attacker need to exploit this?
No authentication or user interaction is required. An attacker needs to send many registration requests concurrently from the same IP address so that the limit checks complete before registrations are recorded.
Is the impact limited to one account being created beyond the limit?
No. Concurrent requests can all pass the per-IP limit check before recordRegistration runs, allowing bulk account creation from one IP and defeating the anti-automation control.
How can defenders determine whether this has been exploited?
Review registration activity for unusually large groups of accounts created within a short period from the same IP address. Such activity may indicate that concurrent requests bypassed the intended daily per-IP limit.