CVE-2026-120450

LaraDashboard versions 1.4.0 before 1.4.9 are susceptible to an improper authorization vulnerability in the MCP send-email tool . Authenticated users possessing only the read-only email_template.view permission can mint an MCP token to send arbitrary emails. This allows an attacker to specify any...