Threats tagged 'ghsa-g452-mgph-pcc8'

LaraDashboard versions from 1.4.0 up to but not including 1.4.9 have an improper authorization vulnerability. Authenticated users with only read-only email_template.view permission can exploit this flaw to send arbitrary emails through the MCP send-email tool. This allows attackers to generate MCP tokens and send emails with any recipient, subject, and raw HTML content, potentially facilitating phishing or spam campaigns.