Vulnerability Description
LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url parameter to EmailTemplateController builder and builderEdit. Attackers can send crafted builder links to logged-in users with email template permissions so saving a template navigates them to attacker-controlled phishing sites.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/laradashboard/laradashboard
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers/
- https://github.com/laradashboard/laradashboard/blob/v1.4.2/resources/js/lara-bui
- https://github.com/laradashboard/laradashboard/commit/c08da68236267afc0c0073598f
- https://github.com/laradashboard/laradashboard/pull/341
- https://github.com/laradashboard/laradashboard/releases/tag/v1.4.8
- https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j2vp-w78
- https://www.vulncheck.com/advisories/laradashboard-before-1.4.8-open-redirect-vi
FAQ
What is CVE-2026-105128?
CVE-2026-105128 is a vulnerability with a CVSS score of 5.4 (MEDIUM). LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url parameter to EmailTemplateController builder ...
How severe is CVE-2026-105128?
CVE-2026-105128 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-105128?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.