LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allows unauthenticated attackers… (CVE-2026-105130)

A race condition vulnerability exists in LaraDashboard's RegisterController::register method in versions 1.4.0 before 1.4.8. The vulnerability allows unauthenticated attackers to circumvent the per-IP daily registration limit by exploiting the timing gap between the check in RegistrationGuardService::hasExceededIpLimit and the actual recording of the registration event. By sending concurrent registration requests, attackers can bypass the limit check before the registration is recorded, enabling bulk account creation.

The vulnerability enables attackers to bypass the intended per-IP daily registration limit, potentially allowing large-scale automated account creation. This can undermine anti-automation and abuse prevention mechanisms, leading to resource exhaustion or fraudulent account creation. The CVSS score is 3.7 (medium), indicating limited impact on confidentiality and availability but some impact on integrity due to unauthorized account creation.

No explicit patch or remediation details are provided. Since the vulnerability affects versions from 1.4.0 before 1.4.8, upgrading to version 1.4.8 or later (if available) is recommended once confirmed by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.