Is CVE-2026-105127 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105127 being exploited in the wild.

How severe is CVE-2026-105127?

Medium severity, with a CVSS score of 5.3, published 4 October 2026.

Which products and versions are affected?

LaraDashboard 1.4.2 before 1.4.8.

Is there a fix for CVE-2026-105127?

Yes: fixed in 1.4.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105127 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-105127?

Check whether you run LaraDashboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105127: LaraDashboard resource exhaustion in password reset validation

CVE-2026-105127 · Severity: medium · CVSS 5.3 · Published 2026-10-04

LaraDashboard is a Laravel-based CMS and application management platform. The password reset and forgot-password forms perform expensive email validation (DNS lookups and paid API calls) on unauthenticated user input without rate limiting. An attacker can exhaust the verification quota to break email validation for legitimate users and probe the target's DNS resolution.

Technologies: LaraDashboard. Vendors: LaraDashboard.

Quick answers

Is CVE-2026-105127 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105127 being exploited in the wild.
How severe is CVE-2026-105127?: Medium severity, with a CVSS score of 5.3, published 4 October 2026.
Which products and versions are affected?: LaraDashboard 1.4.2 before 1.4.8.
Is there a fix for CVE-2026-105127?: Yes: fixed in 1.4.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105127 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-105127?: Check whether you run LaraDashboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.4.8

Technical details

Unauthenticated forgot-password and reset-password endpoints apply advanced email validation via AbstractAPI without quota protection. An attacker can submit arbitrary email addresses to trigger DNS lookups and paid API verification calls, depleting the quota and causing validation to fail open. This allows bypass of email validation on public forms and enables domain resolution probing.

Affected products

LaraDashboard LaraDashboard 1.4.2 before 1.4.8

Timeline

2026-10-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.