CVE-2026-87821
Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 9, 2026
- Updated
- Sep 9, 2026
- Reserved
- Sep 9, 2026
Description
Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IAM credentials by supplying malicious URLs without host validation or redirect restrictions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
laradashboardlaradashboard |
|
References
- GitHub Security Advisory (GHSA-4xqv-4c27-6c4j)vendor-advisory
- GitHub Security Advisory (GHSA-f36j-h77g-6wj8)vendor-advisory
- Fix commit adding SafeUrlValidatorpatch
- Unguarded server-side fetch at v1.3.1technical-description
- Same unguarded fetch at v0.9.2, the first release carrying the servicetechnical-description
- Controller with no authorization check at v1.3.1technical-description
- Host allowlist introduced in v1.3.2technical-description
- laradashboard v1.3.2 Release Notesrelease-notes
- https://github.com/laradashboard/laradashboardproduct
- VulnCheck Advisory: Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetchthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.