CVE-2026-105129CWE-863broken-access-control

CVE-2026-105129

Medium · published October 4, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
22.2
In the wild
Unconfirmed
What it is

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/{option_name} to retrieve plaintext AI provider API keys, mail credentials, passwords and tokens.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00306 · 22.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-04T04:16Z
References (9)
https://github.com/laradashboard/laradashboard · [email protected]https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Api/SettingController.php#L23-L50 · [email protected]https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Resources/SettingResource.php#L17-L26 · [email protected]https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/SettingPolicy.php#L15-L34 · [email protected]https://github.com/laradashboard/laradashboard/commit/532a10efd2cc1338ef3f59236f195df859b2dbe3 · [email protected]https://github.com/laradashboard/laradashboard/pull/340 · [email protected]https://github.com/laradashboard/laradashboard/releases/tag/v1.4.8 · [email protected]https://github.com/laradashboard/laradashboard/security/advisories/GHSA-xgmw-7ppx-v7hq · [email protected]https://www.vulncheck.com/advisories/laradashboard-before-1.4.8-incorrect-authorization-exposes-secrets-via-settings-api · [email protected]
EPSS history
Timeline
  • 07 OCT 03:39Z
    EPSS moved — → 0%
    epss
  • 03 OCT 23:40Z
    LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API
    cvelistv5