Login Request a demo
High severity · published Sep 9, 2026
CVE-2026-87821
Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch
7.1
CVSS
0.5%
EPSS
No
On KEV
Description
Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IAM credentials by supplying malicious URLs without host validation or redirect restrictions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
laradashboard · laradashboard
0.9.2 before 1.3.2 · source: vendor
Affected product
LA
laradashboard
laradashboard
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-87821
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-87821
github.com
https://github.com/laradashboard/laradashboard
github.com
https://github.com/laradashboard/laradashboard/blob/v0.9.2/app/Services/Builder/MarkdownFetchService.php
github.com
https://github.com/laradashboard/laradashboard/blob/v1.3.1/app/Http/Controllers/Api/Builder/MarkdownController.php
github.com
https://github.com/laradashboard/laradashboard/blob/v1.3.1/app/Services/Builder/MarkdownFetchService.php
github.com
https://github.com/laradashboard/laradashboard/blob/v1.3.2/app/Support/Security/SafeUrlValidator.php
github.com
https://github.com/laradashboard/laradashboard/commit/738cc1a219ce459323ef1d09c3789075f1b8d2f2
More from laradashboard
9.8
CVE-2026-86184
Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route
9.8
CVE-2025-66509
LaraDashboard: 1-Click Pre-Auth RCE via Host Header + Module Installation Chain
7.2
CVE-2026-105126
LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering
7.2
CVE-2026-90932
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE
7.2
CVE-2026-86438
Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action