CVE-2026-105127 MEDIUM

CVE-2026-105127: LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints

Vendor Laradashboard

Product laradashboard

Weakness CWE-770 · Uncontrolled resource consumption

Published October 3, 2026

Last update October 5, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making validation fail open for all public forms, and probe domain resolution.

Key dates

02Disclosure timeline

October 3, 2026 CVE published

October 5, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-105127 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/770.html AskarLabs — CWE-770 write-up Allocation of Resources Without Limits or Throttling

Related vulnerabilities

CVE-2026-105127: LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints

01Description

02Disclosure timeline

03References

04Related CVE