LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to… (CVE-2026-105129)

CVE-2026-105129 describes an incorrect authorization vulnerability in LaraDashboard prior to version 1.4.8. Authenticated users possessing only the settings.view permission can exploit this flaw to retrieve sensitive stored secrets by querying the GET /api/settings or /api/settings/{option_name} endpoints. The exposed data includes plaintext API keys, mail credentials, passwords, and tokens, which should be protected from such access. The CVSS 3.1 base score is 6.5, indicating a high severity issue with network attack vector, low attack complexity, and no user interaction required.

The vulnerability allows unauthorized disclosure of sensitive credentials and secrets to users who should not have access to them. This can lead to compromise of AI provider accounts, mail systems, and other services relying on the exposed tokens and passwords. The impact is confidentiality loss without affecting integrity or availability.

A fixed version 1.4.8 or later should be applied to remediate this vulnerability. Since the affected versions are prior to 1.4.8, upgrading to 1.4.8 or newer is recommended. No cloud service remediation applies as this is not a cloud-hosted service. Patch status is not explicitly confirmed in the input, but the version boundary indicates a fix in 1.4.8. Users should verify with the vendor advisory for the official patch and apply it promptly.