CVE-2026-105129

{
  "etk_id": "ETK-2026-518",
  "cve_id": "CVE-2026-105129",
  "display_id": "CVE-2026-105129",
  "ghsa_id": "GHSA-7r4w-923q-fg62",
  "euvd_id": "EUVD-2026-92051",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Incorrect authorization in LaraDashboard settings API",
  "summary": "LaraDashboard versions before 1.4.8 expose stored secrets through the settings API to authenticated users who have only the settings.view permission. Such users may read configured API keys, credentials, passwords, and tokens. The issue requires an authenticated account with that permission.",
  "mitigation": "Upgrade LaraDashboard to version 1.4.8 or later. Until upgraded, restrict settings.view access to trusted administrators and rotate secrets that may have been exposed.",
  "vendor": "laradashboard",
  "product": "laradashboard",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "v1.4.2"
      ],
      "ecosystem": "php,laravel",
      "fixed_versions": [
        "None"
      ],
      "package_name": "laradashboard/laradashboard",
      "purl": null
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0031,
  "epss_percentile": 0.2216,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 30.145078766666668,
  "t0_at": "2026-10-03T23:40:01.650000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-03T09:39:26+00:00",
      "days": -0.5837459490740741,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T23:40:01.650000+00:00",
      "url": "https://github.com/laradashboard/laradashboard/security/advisories/GHSA-xgmw-7ppx-v7hq"
    },
    "trigger_signal": {
      "at": "2026-10-03T23:40:01.650000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T23:40:01.650000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105129"
    }
  }
}