CVE-2026-105127
MEDIUM
6,9
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: low
Description
AI Translation Available
LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making validation fail open for all public forms, and probe domain resolution.
770
Allocation of Resources Without Limits or Throttling
IncompleteCommon Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Dos: Resource Consumption (Other)
Applicable Platforms
All platforms may be affected
https://github.com/laradashboard/laradashboard
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Requests/Au…
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Requests/Au…
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Services/EmailDo…
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Services/EmailVe…
https://github.com/laradashboard/laradashboard/commit/8babc803066a74c628fa01292…
https://github.com/laradashboard/laradashboard/pull/339
https://github.com/laradashboard/laradashboard/releases/tag/v1.4.8
https://github.com/laradashboard/laradashboard/security/advisories/GHSA-5hq2-r2…
https://github.com/laradashboard/laradashboard/security/advisories/GHSA-v36p-85…
https://www.vulncheck.com/advisories/laradashboard-1.4.2-before-1.4.8-resource-…