GHSA-gjfv-h634-pxpv: LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool

Published Nov 2, 2026

Updated

LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only emailtemplate.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.

Event History

Nov 2, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

Any authenticated user granted the read-only email_template.view permission can exploit it. The user can mint an MCP token and invoke the send-email tool without needing a separate permission to send email.

What can an attacker do with access to the MCP send-email tool?

They can send arbitrary emails through the site's configured mailer. The recipient, subject, and raw HTML body can all be attacker-controlled, enabling phishing or spam sent from the application.

Which versions are affected?

LaraDashboard versions from 1.4.0 before 1.4.9 are affected. Version 1.4.9 is not identified as affected by the provided advisory.

GHSA-gjfv-h634-pxpv: LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What can an attacker do with access to the MCP send-email tool?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What can an attacker do with access to the MCP send-email tool?

Which versions are affected?