CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API
Authenticated users with view permissions can read plaintext secrets like API keys and passwords via the settings API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105129?
CVE-2026-105129 is a high-severity missing authorization vulnerability in laradashboard, published on 3 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/{option_name} to retrieve plaintext AI provider API keys, mail credentials, passwords and tokens.
Weakness: CWE-863
Which versions are affected by CVE-2026-105129?
How do I fix CVE-2026-105129?
No fix has been published for CVE-2026-105129 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-105129 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-105129 exists.
Sources
Also known as GHSA-7r4w-923q-fg62, GHSA-xgmw-7ppx-v7hq.