CVE-2026-105130
LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allows unauthenticated attackers to bypass the per-IP daily registration limit. Attackers can send many concurrent registration requests from one IP so all pass RegistrationGuardService::hasExceededIpLimit before recordRegistration runs, creating accounts in bulk and defeating anti-automation controls.
- Published Oct 4, 2026
- CVSS 6.3 medium
- 0.2% chance of exploitation in the next 30 days (EPSS)
- A fix is available