LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/{option_name} to retrieve plaintext AI provider API keys, mail credentials, passwords and tokens.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 9
https://github.com/laradashboard/laradashboard
disclosure@vulncheck.com
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Controllers…
disclosure@vulncheck.com
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Http/Resources/S…
disclosure@vulncheck.com
https://github.com/laradashboard/laradashboard/blob/v1.4.2/app/Policies/Setting…
disclosure@vulncheck.com
https://github.com/laradashboard/laradashboard/commit/532a10efd2cc1338ef3f59236…
disclosure@vulncheck.com
https://github.com/laradashboard/laradashboard/pull/340
disclosure@vulncheck.com
https://github.com/laradashboard/laradashboard/releases/tag/v1.4.8
disclosure@vulncheck.com
https://github.com/laradashboard/laradashboard/security/advisories/GHSA-xgmw-7p…
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/laradashboard-before-1.4.8-incorrect-autho…
disclosure@vulncheck.com