LaraDashboard releases before 1.4.8 contain an incorrect authorization flaw that permits users with only a settings.view permission to retrieve stored secrets. The vulnerability enables query of GET /api/settings or /api/settings/{option_name}, exposing plaintext AI provider API keys, mail credentials, passwords and tokens to the authenticated attacker.

The vulnerability affects installations of LaraDashboard prior to version 1.4.8. Any build of the laradashboard:laradashboard product that does not incorporate the 1.4.8 release is vulnerable. Administrators and developers should verify the running version and apply the fix if the application predates 1.4.8.

The flaw carries a CVSS score of 7.1, categorizing it as a high severity issue. Since the exploit requires only that an attacker be authenticated, the attack vector is likely to be internal or via compromised credentials. EPSS data is not available, and the vulnerability has not been added to the CISA KEV catalog. Consequently, the practical risk remains high for organizations that have not upgraded; an attacker could read all secrets exposed through the Settings API.