Live › vulnerability › CVE-2026-120450
LaraDashboard 1.4.0 before 1.4.9 lets an authenticated user with only read-only email template permission call the MCP send-email tool. An attacker can use it to send arbitrary phishing or spam from the site's own mailer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Teams running LaraDashboard from 1.4.0 up to but not including 1.4.9 that have the MCP send-email tool reachable by authenticated users. Users with only read-only email template access can abuse it, so the risk depends on how many accounts exist and who holds that permission. Installations on versions 1.4.9 or later, or without the MCP server, are not affected.
No product ranges from the sources yet.
1.4.9email_template.view1.4.9 or later (the fixed version named in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.
This page as .md · .json · in your agent: get_signal("CVE-2026-120450")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.