rootpwn

medium · CVSS v3 3.7 · CVSS v4 6.3 · EPSS 0.00223

CVE-2026-105130

LaraDashboard versions 1.4.0 through 1.4.7 contain a race condition in the registration flow that lets attackers create accounts from a sing

Overview

LaraDashboard versions 1.4.0 through 1.4.7 contain a race condition in the registration flow that lets attackers create accounts from a single IP without hitting the daily limit. This bypasses anti‑automation controls and can lead to mass account creation. The flaw is triggered by concurrent registration requests.

Description

LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allows unauthenticated attackers to bypass the per-IP daily registration limit. Attackers can send many concurrent registration requests from one IP so all pass RegistrationGuardService::hasExceededIpLimit before recordRegistration runs, creating accounts in bulk and defeating anti-automation controls.

Impact

Confidentiality: attackers can create arbitrary user accounts, potentially gaining access to privileged resources. Integrity: the system's anti‑automation controls are subverted, allowing automated account creation. Availability: large numbers of accounts may strain resources. Defenders: administrators of LaraDashboard installations must patch or mitigate.

Remediation

Apply the official patch to upgrade to version 1.4.8 or later. If upgrade is not possible, enforce per‑IP rate limiting at the web server or firewall level, or add a lock around the registration guard to serialize requests.

Risk context

The CVE has a medium severity score (CVSS v3 3.7, v4 6.3) and a very low EPSS of 0.00223, indicating a low likelihood of exploitation in the wild. Nonetheless, the vulnerability can be abused by automated scripts to create many accounts, so timely patching is recommended.

Affected products

  • LaraDashboard 1.4.0-1.4.7

Scores

Severity
medium
CVSS v2
2.6
CVSS v3
3.7
CVSS v4
6.3
EPSS
0.00223

race condition registration rate limiting account creation LaraDashboard medium severity EPSS low

← All CVEs

Related CVEs

medium

CVE-2026-105144

A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the component Static File Router. Executing a manipulation can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-105205

SiYuan versions prior to 3.8.5 allow publish‑mode readers to retrieve backlink block IDs and reference counts from password‑protected or publish‑disabled documents via API calls. This exposes hidden metadata that should remain confidential. The flaw is exploitable by sending POST requests to /api/block/getDocInfo or getDocsInfo for a published document ID.

View analysis

medium

CVE-2026-97927

The CVE-2026-97927 flaw in the Linux kernel’s UFS filesystem causes an oops during mount teardown when cylinder group reading fails, potentially crashing the kernel. It occurs only when a writable UFS image has a corrupted first cylinder group. The issue is mitigated by applying the kernel patch that reorders root dentry creation.

View analysis

medium

CVE-2026-105096

CVE-2026-105096 is an authorization bypass vulnerability in the Customer Profile API of Omega Solution CoinEx Crypto 2025. By manipulating the ID parameter in the /customer/ endpoint, an attacker can gain unauthorized access to customer data. The flaw is exploitable remotely and has been publicly disclosed.

View analysis