Is CVE-2026-105129 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-105129?

CVE-2026-105129 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-105129

Description

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/{option_name} to retrieve plaintext AI provider API keys, mail credentials, passwords and tokens.