Technical impact
LaraDashboard users 1.4.2 through 1.4.7 implement an advanced email validation routine that triggers DNS lookups and external verification calls for every unauthenticated request to the Forgot-Password and Reset-Password endpoints. An attacker can supply arbitrary email addresses to the forms, eroding the verification quota supplied by the paid API. When the quota is exhausted, the framework treats all public forms as invalid and rejects submissions, effectively denying legitimate users access to these functions while also revealing whether a domain resolves. The flaw qualifies as a CWE-770 validation failure that can lead to resource exhaustion.
Affected Systems
The vulnerability is limited to the Laradashboard product, version 1.4.2 through any release before 1.4.8. Administrators should verify whether they have installed a supported version of the LaraDashboard application and plan remediation accordingly.
Risk and Exploitability
The CVSS score of 6.9 indicates a medium-severity issue, and while an EPSS value is not supplied, the lack of a KEV listing suggests no widespread exploitation has been observed yet. The required attack vector is remote, mediated by unauthenticated HTTP(S) requests to the password-recovery routes. Because the exploit requires only sending many requests, an attacker with internet connectivity can launch the attack without additional privileges, making the resource exhaustion a serious availability concern for public deployments.
