Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck

CVE-2026-87821Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

High 7.1

In plain English

A high-severity server-side request forgery in laradashboard from laradashboard. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.5%top 59.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IAM credentials by supplying malicious URLs without host validation or redirect restrictions.

Affected products (as reported)

Vendor	Product	Versions
laradashboard	laradashboard	0.9.2 – before 1.3.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-4xqv-4c27-6c4j) vendor-advisory
GitHub Security Advisory (GHSA-f36j-h77g-6wj8) vendor-advisory
Fix commit adding SafeUrlValidator patch
Unguarded server-side fetch at v1.3.1 technical-description
Same unguarded fetch at v0.9.2, the first release carrying the service technical-description
Controller with no authorization check at v1.3.1 technical-description
Host allowlist introduced in v1.3.2 technical-description
laradashboard v1.3.2 Release Notes release-notes
https://github.com/laradashboard/laradashboard product
VulnCheck Advisory: Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch third-party-advisory