The vulnerability in LaraDashboard versions 1.4.0 through 1.4.8 allows an authenticated user who only has read‑only access to email templates to forge and send arbitrary emails using the MCP send‑email tool. The authorization checks that would normally restrict this action were bypassed, enabling attackers to generate an MCP token and call the tool with any recipient, subject and raw HTML body. This can be used to deliver phishing or spam messages that appear to originate from the site, impacting user trust and potentially leading to credential compromise.

Affected systems are installations of LaraDashboard 1.4.0 up to (but not including) 1.4.9. The vulnerability is tied to the MCP send‑email component located in the app/Mcp/Tools/SendEmailTool.php file. Versions 1.4.9 and later contain the fix. The product is identified as LaraDashboard by the CNA, and the affected versions are specifically 1.4.0 through 1.4.8.

The CVSS score of 5.3 indicates medium severity. No EPSS score is available, and the flaw is not listed in the CISA known‑exploited catalog. Because the flaw requires an authenticated user with the read‑only email_template.view permission, exploitation is limited to accounts already granted that permission. If such accounts exist, an attacker can craft MCP tokens and walk the ability to send arbitrary email. The lack of a public exploit suggests the risk is moderate but not negligible for environments where email is a critical communication channel.