Medium severity · published Oct 3, 2026
CVE-2026-105129
LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/{option_name} to retrieve plaintext AI provider API keys, mail credentials, passwords and tokens.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
laradashboard · laradashboard
before 1.4.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-105129
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-105129
vendor-advisory
https://github.com/laradashboard/laradashboard/security/advisories/GHSA-xgmw-7ppx-v7hq
technical-description
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/Api/SettingController.php#L23-L50
technical-description
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Resources/SettingResource.php#L17-L26
technical-description
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/SettingPolicy.php#L15-L34
patch
https://github.com/laradashboard/laradashboard/pull/340
patch
https://github.com/laradashboard/laradashboard/commit/532a10efd2cc1338ef3f59236f195df859b2dbe3
More from laradashboard
9.8
CVE-2026-86184
Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route
9.8
CVE-2025-66509
LaraDashboard: 1-Click Pre-Auth RCE via Host Header + Module Installation Chain
7.2
CVE-2026-105126
LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering
7.2
CVE-2026-90932
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE
7.2
CVE-2026-86438
Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action