CVE-2026-120450

A flaw was found in LaraDashboard. An improper authorization vulnerability allows an authenticated attacker with read-only permissions to dispatch arbitrary emails through the Model Context Protocol MCP send-email tool. By acquiring an MCP token and invoking the tool, an attacker can send...