Login Request a demo
Medium severity · published Oct 3, 2026
CVE-2026-105127
LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making validation fail open for all public forms, and probe domain resolution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
laradashboard · laradashboard
1.4.2 before 1.4.8 · source: vendor
Affected product
LA
laradashboard
laradashboard
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105127
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105127
vendor-advisory
https://github.com/laradashboard/laradashboard/security/advisories/GHSA-v36p-8578-8gch
vendor-advisory
https://github.com/laradashboard/laradashboard/security/advisories/GHSA-5hq2-r2f3-9vp9
technical-description
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Requests/Auth/ForgotPasswordRequest.php#L22-L27
technical-description
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Requests/Auth/ResetPasswordRequest.php#L23-L30
technical-description
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Services/EmailVerificationService.php#L95-L114
technical-description
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Services/EmailDomainCheckService.php#L128
More from laradashboard
9.8
CVE-2026-86184
Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route
9.8
CVE-2025-66509
LaraDashboard: 1-Click Pre-Auth RCE via Host Header + Module Installation Chain
7.2
CVE-2026-105126
LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering
7.2
CVE-2026-90932
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE
7.2
CVE-2026-86438
Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action