CVE-2026-120450
Description
A flaw was found in LaraDashboard. An improper authorization vulnerability allows an authenticated attacker with read-only permissions to dispatch arbitrary emails through the Model Context Protocol (MCP) send-email tool. By acquiring an MCP token and invoking the tool, an attacker can send unauthorized messages with custom recipients, subjects, and content directly from the application's mail service.
Statement
This vulnerability is rated as Moderate impact because exploitation requires existing authenticated access with specific read permissions, limiting the blast radius to unauthorized message transmission rather than underlying host compromise. LaraDashboard is not packaged or distributed within Red Hat products, and there is no direct impact on supported Red Hat environments.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
