LaraDashboard CVE-2026-105127

Exploitation requires that LaraDashboard's advanced email validation be configured and enabled (the domain-check / AbstractAPI verification integration, gated in the code by settings such as auth_registration_email_domain_check_enabled), and that these advanced checks be wired into the unauthenticated ForgotPasswordRequest and ResetPasswordRequest paths as they are in 1.4.2-1.4.7. If advanced email validation / the AbstractAPI integration is not configured, there is no paid quota to exhaust and impact is limited to DNS lookups. The patch removes advanced validation from these recovery endpoints (includeAdvancedEmailValidation: false), so only versions 1.4.2 up to but not including 1.4.8 are affected. No authentication or user interaction is needed, and default reachability of the public forgot-password/reset-password forms is the only access prerequisite.

This is a moderate-severity resource-exhaustion / abuse-of-functionality issue (CWE-770), not a high-urgency flaw despite the network-facing, unauthenticated vector. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, low-complexity, unauthenticated reachability, but the only impact metric set is VA:L - a low availability impact - with no confidentiality or integrity impact (VC:N/VI:N), which is consistent with the real-world effect: exhausting a paid AbstractAPI verification quota and triggering DNS lookups rather than compromising data or code. No EPSS score, KEV listing, or POC was provided, so exploitation likelihood cannot be quantified from the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. The secondary 'fail-open' consequence - once quota is exhausted, email validation silently passes for ALL public forms - is a real security-control-degradation concern that the raw CVSS score arguably under-weights, since it weakens anti-abuse/disposable-domain protections site-wide; teams should weigh that logic-level impact alongside the modest CVSS number. Overall this is a legitimate hardening/availability fix worth patching, but it is a 'medium CVSS, limited blast radius' issue rather than a critical priority, and its urgency is further reduced by the niche deployment footprint of the affected product.

An unauthenticated attacker repeatedly submits forged or arbitrary email addresses to LaraDashboard's public forgot-password and reset-password endpoints, each request triggering a billable AbstractAPI verification call and a DNS lookup. Once the paid verification quota is depleted, the advanced email validation fails open across all public forms, degrading anti-abuse controls, while the DNS lookups also let the attacker probe domain resolution. No public exploit is identified at time of analysis, but the attack requires only a simple scripted loop of HTTP POST requests.