This vulnerability is a race condition in the registration controller that allows an unauthenticated attacker to send many concurrent registration requests from the same IP address. By timing the requests so that all bypass the per‑IP limit check before the record is written, the attacker can create an arbitrary number of user accounts in a single day, undermining anti‑automation controls and potentially enabling spamming or other malicious use.

LaraDashboard versions 1.4.0 through 1.4.7 are affected. The issue is fixed in version 1.4.8 and later. The vendor is laradashboard:laradashboard.

The CVSS score of 6.3 indicates a moderate severity. No EPSS score is publicly available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. The likely attack vector is remote: an attacker can trigger the race condition by submitting numerous simultaneous registration requests from a single IP. Successful exploitation permits uncontrolled user registration, potentially disrupting service availability or enabling abusive registrants.