LaraDashboard CVE-2026-105128

Requires (1) a victim who is an authenticated LaraDashboard user possessing email-template permissions, (2) that victim to open an attacker-supplied link to the EmailTemplateController builder or builderEdit endpoint carrying a crafted redirect_url parameter, and (3) the victim to trigger a template save, at which point the unvalidated redirect_url (pre-1.4.8, used raw without the SafeRedirectValidator introduced in the patch) sends the browser to the attacker destination. Limiting factors: exploitation needs passive user interaction (UI:P) and a privileged authenticated victim, so it cannot be driven against anonymous visitors or default unauthenticated surfaces; impact is confined to redirection enabling phishing rather than direct compromise of the application.

This is a medium-severity (CVSS 4.0 base 5.3) open redirect (CWE-601) whose real-world risk is modest and bounded. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N) indicates network reach and no attacker privileges, but mandatory passive user interaction (UI:P) and the fact that the vulnerable builder/builderEdit endpoints live in the authenticated backend mean the VICTIM must already be a logged-in user holding email-template permissions - a meaningful constraint on scale. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so there is no signal of automated or active exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' The impact is limited to phishing/credential-harvesting enablement (low confidentiality/integrity, no availability), not direct code execution or data theft. Net: a legitimate issue to patch during routine maintenance, not an emergency - the high-sounding 'remote unauthenticated' framing is tempered because it requires tricking an authenticated privileged user into clicking a crafted link and saving a template. Note: PR:N describes the ATTACKER (who needs no account to craft the link); the authenticated-victim requirement is expressed through UI:P and the backend endpoint, not through PR.

An attacker crafts a link to the EmailTemplateController builder/builderEdit endpoint with a malicious redirect_url parameter pointing to an attacker-controlled site, then delivers it (e.g., via email) to a LaraDashboard user who holds email-template permissions. When that logged-in user opens the builder and saves the template, the application redirects their browser to the attacker's phishing page, which can impersonate the dashboard login to harvest credentials. No public exploit code was identified in the provided data, though the vendor advisory and patch diff make the mechanism clear.