CVE-2026-105128
MEDIUM
5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
5,4
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: none
Description
AI Translation Available
LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url parameter to EmailTemplateController builder and builderEdit. Attackers can send crafted builder links to logged-in users with email template permissions so saving a template navigates them to attacker-controlled phishing sites.
601
URL Redirection to Untrusted Site ('Open Redirect')
DraftCommon Consequences
Security Scopes Affected:
Access Control
Confidentiality
Other
Potential Impacts:
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Other
Applicable Platforms
Technologies:
Web Based, Web Server
https://github.com/laradashboard/laradashboard
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers…
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers…
https://github.com/laradashboard/laradashboard/blob/v1.4.2/resources/js/lara-bu…
https://github.com/laradashboard/laradashboard/commit/c08da68236267afc0c0073598…
https://github.com/laradashboard/laradashboard/pull/341
https://github.com/laradashboard/laradashboard/releases/tag/v1.4.8
https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j2vp-w7…
https://www.vulncheck.com/advisories/laradashboard-before-1.4.8-open-redirect-v…